Date: Fri, 19 Mar 2021 10:16:59 +0100 From: Vardan Torosyan <vardan.torosyan@...fana.com> To: oss-security@...ts.openwall.com Subject: Grafana 7.4.5, 7.3.10 and 6.7.6 released with security fixes for Grafana Enterprose Dear all, We have released Grafana 7.4.5, 7.3.10 and 6.7.6 with important security fixes for all Grafana Enterprise versions from 6.1.0-beta1 through 7.4.4. Grafana OSS is not affected, as it does not use the features affected by vulnerabilities. *Remote Escalation of Privileges vulnerability (CVE-2021-27962)* On the 26th of February during an internal security audit, we discovered that Grafana Enterprise 7.2.0 introduced a mechanism which allows users with the Editor role to bypass data source permissions on an organization’s default data source, if configured. To our knowledge, this has not been detected by anyone else. Affected versions: Grafana Enterprise releases 7.2.0 through 7.4.3 are affected by this vulnerability. Patched versions: 7.3.x and 7.4.x *Remote Access Control Bypass vulnerabilities (CVE-2021-28146, CVE-2021-28147)* On the 10th of March during our internal security audit, we discovered that on Grafana Enterprise instances using an external authentication service, Grafana Enterprise 7.4.0 introduced a mechanism which allows any authenticated user to add external groups to existing teams. We have reserved CVE-2021-28146 for this issue. As we continued an internal audit, on the 11th of March we discovered that Grafana Enterprise 6.1.0 introduced the same vulnerability as above, but only for Grafana instances which have editorsCanAdmin feature enabled. We have reserved CVE-2021-28147for this issue. Affected versions: Grafana Enterprise 7.4.0-beta1 through 7.4.4 are affected by CVE-2021-28146 and 6.1.0-beta1 through 7.4.4 are affected by CVE-2021-28147. Patched versions: 6.x, 7.3.x and 7.4.x *Remote Unauthenticated Denial of Service vulnerability (CVE-2021-28148)* On the 11th of March during our internal security audit, we discovered that Grafana Enterprise 6.6.0 introduced a new HTTP API endpoint for usage insights which allows any unauthenticated user to send an unlimited number of requests to the endpoint, leading to a denial of service (DoS) attacks against Grafana Enterprise instances. Affected versions: Grafana Enterprise 6.6.0-beta1 to 7.4.4 Patched versions: 6.x, 7.3.x and 7.4.x *Solutions and mitigations* Download and install the appropriate patch for your version of Grafana. Affected Grafana Cloud instances have been already upgraded to the versions with fix. Grafana Enterprise customers have been provided with updated binaries ahead of this disclosure. Further information can be found at https://grafana.com/blog/2021/03/18/grafana-6.7.6-7.3.10-and-7.4.5-released-with-important-security-fixes-for-grafana-enterprise/ Best Regards, Vardan Torosyan
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.