[<prev] [next>] [day] [month] [year] [list]
Date: Fri, 19 Mar 2021 10:16:59 +0100
From: Vardan Torosyan <vardan.torosyan@...fana.com>
To: oss-security@...ts.openwall.com
Subject: Grafana 7.4.5, 7.3.10 and 6.7.6 released with security fixes for
Grafana Enterprose
Dear all,
We have released Grafana 7.4.5, 7.3.10 and 6.7.6 with important security
fixes for all Grafana Enterprise versions from 6.1.0-beta1 through 7.4.4.
Grafana OSS is not affected, as it does not use the features affected by
vulnerabilities.
*Remote Escalation of Privileges vulnerability (CVE-2021-27962)*
On the 26th of February during an internal security audit, we discovered
that Grafana Enterprise 7.2.0 introduced a mechanism which allows users
with the Editor role to bypass data source permissions on an organization’s
default data source, if configured. To our knowledge, this has not been
detected by anyone else.
Affected versions: Grafana Enterprise releases 7.2.0 through 7.4.3 are
affected by this vulnerability.
Patched versions: 7.3.x and 7.4.x
*Remote Access Control Bypass vulnerabilities (CVE-2021-28146,
CVE-2021-28147)*
On the 10th of March during our internal security audit, we discovered that
on Grafana Enterprise instances using an external authentication service,
Grafana Enterprise 7.4.0 introduced a mechanism which allows any
authenticated user to add external groups to existing teams. We have
reserved CVE-2021-28146 for this issue.
As we continued an internal audit, on the 11th of March we discovered that
Grafana Enterprise 6.1.0 introduced the same vulnerability as above, but
only for Grafana instances which have editorsCanAdmin feature enabled. We
have reserved CVE-2021-28147for this issue.
Affected versions: Grafana Enterprise 7.4.0-beta1 through 7.4.4 are
affected by CVE-2021-28146 and 6.1.0-beta1 through 7.4.4 are affected by
CVE-2021-28147.
Patched versions: 6.x, 7.3.x and 7.4.x
*Remote Unauthenticated Denial of Service vulnerability (CVE-2021-28148)*
On the 11th of March during our internal security audit, we discovered
that Grafana
Enterprise 6.6.0 introduced a new HTTP API endpoint for usage insights
which allows any unauthenticated user to send an unlimited number of
requests to the endpoint, leading to a denial of service (DoS) attacks
against Grafana Enterprise instances.
Affected versions: Grafana Enterprise 6.6.0-beta1 to 7.4.4
Patched versions: 6.x, 7.3.x and 7.4.x
*Solutions and mitigations*
Download and install the appropriate patch for your version of Grafana.
Affected Grafana Cloud instances have been already upgraded to the versions
with fix. Grafana Enterprise customers have been provided with updated
binaries ahead of this disclosure.
Further information can be found at
https://grafana.com/blog/2021/03/18/grafana-6.7.6-7.3.10-and-7.4.5-released-with-important-security-fixes-for-grafana-enterprise/
Best Regards,
Vardan Torosyan
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
