SUSE-SU-2023:2917-1
Security update for SUSE Manager Client Tools
Severidad por fuente
Ninguna fuente da una puntuación CVSS.
La etiqueta propia de Trivy es CRITICAL. Crítica según SUSE.
Descripción
This update fixes the following issues: grafana: - Update to version 9.5.5: * CVE-2023-3128: Fix authentication bypass using Azure AD OAuth (bsc#1212641, jsc#PED-3694) * Bug fixes: * Auth: Show invite button if disable login form is set to false. * Azure: Fix Kusto auto-completion for Azure datasources. * RBAC: Remove legacy AC editor and admin role on new dashboard route. * API: Revert allowing editors to access GET /datasources. * Settings: Add ability to override skip_org_role_sync with Env variables. - Update to version 9.5.3: * CVE-2023-2801: Query: Prevent crash while executing concurrent mixed queries (bsc#1212099) * CVE-2023-2183: Alerting: Require alert.notifications:write permissions to test receivers and templates (bsc#1212100) - Update to version 9.5.2: Alerting: Scheduler use rule fingerprint instead of version. Explore: Update table min height. DataLinks: Encoded URL fixed. TimeSeries: Fix leading null-fill for missing intervals. Dashboard: Revert fixed header shown on mobile devices in the new panel header. PostgreSQL: Fix TLS certificate issue by downgrading lib/pq. Provisioning: Fix provisioning issues with legacy alerting and data source permissions. Alerting: Fix misleading status code in provisioning API. Loki: Fix log samples using `instant` queries. Panel Header: Implement new Panel Header on Angular Panels. Azure Monitor: Fix bug that was not showing resources for certain locations. Alerting: Fix panic when reparenting receivers to groups following an attempted rename via Provisioning. Cloudwatch Logs: Clarify Cloudwatch Logs Limits. - Update to 9.5.1 Loki Variable Query Editor: Fix bug when the query is updated Expressions: Fix expression load with legacy UID -100
Paquetes afectados y versiones corregidas
| Fuente | Paquete | Corregido en |
|---|---|---|
| openSUSE Leap 15.4 | grafana | 9.5.5-150200.3.44.1 |
| openSUSE Leap 15.5 | grafana | 9.5.5-150200.3.44.1 |
| SUSE Linux Enterprise 15.4 | grafana | 9.5.5-150200.3.44.1 |
| SUSE Linux Enterprise 15.5 | grafana | 9.5.5-150200.3.44.1 |
Referencias
- https://bugzilla.suse.com/1212099
- https://bugzilla.suse.com/1212100
- https://bugzilla.suse.com/1212641
- https://lists.suse.com/pipermail/sle-updates/2023-July/030437.html
- https://www.suse.com/security/cve/CVE-2023-2183/
- https://www.suse.com/security/cve/CVE-2023-2801/
- https://www.suse.com/security/cve/CVE-2023-3128/
- https://www.suse.com/support/security/rating/