From nobody Sun Nov 13 00:19:13 2022 X-Original-To: dev-commits-ports-main@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4N8tNK2vcwz4d9cw; Sun, 13 Nov 2022 00:19:13 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "R3" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4N8tNK2T9jz4FBt; Sun, 13 Nov 2022 00:19:13 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1668298753; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=qLIEkUsziQiL+wYdskCwVHArdBLcnbhzf3hwWqKEPog=; b=hmuq+b1E3Ot+vumCeK5Ll+ijX1iRKkuDMcg6Y71mVs/kXlX/d1rKh8nVwo/rLpyw/gO8zv uGTs+iruZzUKZvWqA/RsmclVsDNfD/hWaDjphT0EXGEabS7wHhJr2H+LstSB7b9NA/PjCX SlViYaunEwPcJB4ocSMlIhIivPwQdHJL973iWW/tsOwLr1GNb/UQ+nOOqBg0kJqsVepTVv Is3ZsxH/ExdB+cxiOODhhw5vfs8Cv488z8ThI2aMgQC+UlAeWDmBTSAU63uDcjhZw9fgIS Cd4ddnLrmRnbDQWEs8QDmz/XhdveXEZcmRPWZO719HxIDuxIjw4Vh9YDp/jDoA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1668298753; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=qLIEkUsziQiL+wYdskCwVHArdBLcnbhzf3hwWqKEPog=; b=wCWSQ56nDjTL8mWYAvYmKLBlDYIy0IJAbXUOLrl5BAQ/QoosOgneRj4vHdtKD9hVJYI+fn S21EQd2mztKkgZ2uCIHMk7ij8xxS3GLS6m6dkQ+5EFQCbDw3TWfi1veNgIGfMUyCsAZoFa qif6ALYVuIrccAYcLnhCvbKbhwWeMQ6wKqOqSZIZRrmw2ZOYrNbQ2vDCaXldQCOCLsZ9u1 bh/qBvmNgpBVlb96YYJ3+tU9WsH2iXvkDTiR8KyzMQBnnDkkopsMvRaEGFhDw6csFvyVHC K87YAp53UkhcJuqHCx8j6Flyer8fHKnaw4ZUOLJEEmq64nHqMQsc8l0ufMQgDQ== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1668298753; a=rsa-sha256; cv=none; b=VhYgFLv6VpJvY1wORkSgB56HrvsxBPEkYAzSPcS5osLAjM3S3u73EIGXxYCR7jYPv4bh+D I1bUbDHteUNfdyjsAoTA+l1hXAY4F+twnOXqB4igEX+VLHjR75LxRt/Uo8SscqQ+k/fhtO ksNQVQAz0UuV7ELmsVtowVs2Y8CG3AzWV0SURiwdGXjjCZ/NYC2VgLInTrxTdupRopS59e hzMS6CkkqPtmZSwfiBN594T48itY7SFPC+Xxon8s71AOK2EQyolINgM0EahvhoatV5XyXz m9akHEn97AIliRbrcaod1UVFDueOhP9LYqoo3cca+E7Bp9tB5vwQuyLZNowEeg== ARC-Authentication-Results: i=1; mx1.freebsd.org; none Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id 4N8tNK1Qwczj0t; Sun, 13 Nov 2022 00:19:13 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from gitrepo.freebsd.org ([127.0.1.44]) by gitrepo.freebsd.org (8.16.1/8.16.1) with ESMTP id 2AD0JDCe042219; Sun, 13 Nov 2022 00:19:13 GMT (envelope-from git@gitrepo.freebsd.org) Received: (from git@localhost) by gitrepo.freebsd.org (8.16.1/8.16.1/Submit) id 2AD0JDeb042218; Sun, 13 Nov 2022 00:19:13 GMT (envelope-from git) Date: Sun, 13 Nov 2022 00:19:13 GMT Message-Id: <202211130019.2AD0JDeb042218@gitrepo.freebsd.org> To: ports-committers@FreeBSD.org, dev-commits-ports-all@FreeBSD.org, dev-commits-ports-main@FreeBSD.org From: Nuno Teixeira Subject: git: 69889d2f8d57 - main - security/vuxml: Document Grafana multiple vulnerabilities List-Id: Commits to the main branch of the FreeBSD ports repository List-Archive: https://lists.freebsd.org/archives/dev-commits-ports-main List-Help: List-Post: List-Subscribe: List-Unsubscribe: Sender: owner-dev-commits-ports-main@freebsd.org X-BeenThere: dev-commits-ports-main@freebsd.org MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: eduardo X-Git-Repository: ports X-Git-Refname: refs/heads/main X-Git-Reftype: branch X-Git-Commit: 69889d2f8d57226190eebde1f7391bcd1478b760 Auto-Submitted: auto-generated X-ThisMailContainsUnwantedMimeParts: N The branch main has been updated by eduardo: URL: https://cgit.FreeBSD.org/ports/commit/?id=69889d2f8d57226190eebde1f7391bcd1478b760 commit 69889d2f8d57226190eebde1f7391bcd1478b760 Author: Boris Korzun AuthorDate: 2022-11-12 21:26:41 +0000 Commit: Nuno Teixeira CommitDate: 2022-11-13 00:18:39 +0000 security/vuxml: Document Grafana multiple vulnerabilities * CVE-2022-31123 - Plugin signature bypass * CVE-2022-31130 - Data source and plugin proxy endpoints leaking authentication tokens to some destination plugins * CVE-2022-39201 - Data source and plugin proxy endpoints leaking authentication tokens to some destination plugins * CVE-2022-39229 - Improper authentication * CVE-2022-39306 - Privilege escalation * CVE-2022-39307 - Username enumeration * CVE-2022-39328 - Privilege escalation (Critical) https://grafana.com/blog/2022/10/12/grafana-security-releases-new-versions-with-fixes-for-cve-2022-39229-cve-2022-39201-cve-2022-31130-cve-2022-31123/ https://grafana.com/blog/2022/11/08/security-release-new-versions-of-grafana-with-critical-and-moderate-fixes-for-cve-2022-39328-cve-2022-39307-and-cve-2022-39306/ PR: 267728 --- security/vuxml/vuln-2022.xml | 297 +++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 297 insertions(+) diff --git a/security/vuxml/vuln-2022.xml b/security/vuxml/vuln-2022.xml index 8512818a38d5..6b90b9fda12e 100644 --- a/security/vuxml/vuln-2022.xml +++ b/security/vuxml/vuln-2022.xml @@ -1,3 +1,300 @@ + + Grafana -- Username enumeration + + + grafana + 8.0.08.5.15 + 9.0.09.2.4 + + + grafana8 + 8.0.08.5.15 + + + grafana9 + 9.0.09.2.4 + + + + +

Grafana Labs reports:

+
+

When using the forget password on the login page, a POST request is made + to the /api/user/password/sent-reset-email URL. When the username + or email does not exist, a JSON response contains a “user not found” message. +

+

The CVSS score for this vulnerability is 5.3 Moderate

+
+ + + + CVE-2022-39307 + https://github.com/grafana/grafana/security/advisories/GHSA-3p62-42x7-gxg5 + + + 2022-10-24 + 2022-11-12 + + + + + Grafana -- Privilege escalation + + + grafana + 8.0.08.5.15 + 9.0.09.2.4 + + + grafana8 + 8.0.08.5.15 + + + grafana9 + 9.0.09.2.4 + + + + +

Grafana Labs reports:

+
+

Grafana admins can invite other members to the organization they are + an admin for. When admins add members to the organization, non existing users + get an email invite, existing members are added directly to the organization. + When an invite link is sent, it allows users to sign up with whatever + username/email address the user chooses and become a member of the organization. +

+

The CVSS score for this vulnerability is 6.4 Moderate

+
+ + + + CVE-2022-39306 + https://github.com/grafana/grafana/security/advisories/GHSA-2x6g-h2hg-rq84 + + + 2022-10-24 + 2022-11-12 + + + + + Grafana -- Privilege escalation + + + grafana + 9.2.09.2.4 + + + grafana9 + 9.2.09.2.4 + + + + +

Grafana Labs reports:

+
+

Internal security audit identified a race condition in the Grafana codebase, + which allowed an unauthenticated user to query an arbitrary endpoint in Grafana. + A race condition in the + HTTP context creation could make a HTTP request being assigned + the authentication/authorization middlewares of another call. Under heavy load + it is possible that a call protected by a privileged middleware receives instead + the middleware of a public query. As a result, an unauthenticated user can + successfully query protected endpoints.

+

The CVSS score for this vulnerability is 9.8 Critical

+
+ + + + CVE-2022-39328 + https://github.com/grafana/grafana/security/advisories/GHSA-vqc4-mpj8-jxch + + + 2022-11-08 + 2022-11-12 + + + + + Grafana -- Plugin signature bypass + + + grafana + 7.0.08.5.14 + 9.0.09.1.8 + + + grafana7 + 7.0.0 + + + grafana8 + 8.0.08.5.14 + + + grafana9 + 9.0.09.1.8 + + + + +

Grafana Labs reports:

+
+

On July 4th as a result of an internal security audit we have discovered + a bypass in the plugin signature verification by exploiting a versioning flaw.

+

We believe that this vulnerability is rated at CVSS 6.1 + (CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:L).

+
+ + + + CVE-2022-31123 + https://github.com/grafana/grafana/security/advisories/GHSA-rhxj-gh46-jvw8 + + + 2022-07-04 + 2022-11-12 + + + + + Grafana -- Data source and plugin proxy endpoints leaking authentication tokens to some destination plugins + + + grafana + 7.0.08.5.14 + 9.0.09.1.8 + + + grafana7 + 7.0.0 + + + grafana8 + 8.0.08.5.14 + + + grafana9 + 9.0.09.1.8 + + + + +

Grafana Labs reports:

+
+

On June 26 a security researcher contacted Grafana Labs to disclose + a vulnerability with the GitLab data source plugin that could leak the API key + to GitLab. After further analysis the vulnerability impacts data source + and plugin proxy endpoints with authentication tokens but under some conditions.

+

We believe that this vulnerability is rated at CVSS 4.9 + (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N)

+
+ + + + CVE-2022-31130 + https://github.com/grafana/grafana/security/advisories/GHSA-jv32-5578-pxjc + + + 2022-06-26 + 2022-11-12 + + + + + Grafana -- Data source and plugin proxy endpoints leaking authentication tokens to some destination plugins + + + grafana + 5.0.08.5.14 + 9.0.09.1.8 + + + grafana7 + 7.0.0 + + + grafana8 + 8.0.08.5.14 + + + grafana9 + 9.0.09.1.8 + + + + +

Grafana Labs reports:

+
+

On September 7th as a result of an internal security audit we have discovered + that Grafana could leak the authentication cookie of users to plugins. After + further analysis the vulnerability impacts data source and plugin proxy + endpoints under certain conditions.

+

We believe that this vulnerability is rated at CVSS 6.8 + (CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H)

+
+ + + + CVE-2022-39201 + https://github.com/grafana/grafana/security/advisories/GHSA-x744-mm8v-vpgr + + + 2022-09-07 + 2022-11-12 + + + + + Grafana -- Improper authentication + + + grafana + 8.0.08.5.14 + 9.0.09.1.8 + + + grafana8 + 8.0.08.5.14 + + + grafana9 + 9.0.09.1.8 + + + + +

Grafana Labs reports:

+
+

On September 7, as a result of an internal security audit, we discovered + a security vulnerability in Grafana’s basic authentication related to the usage + of username and email address.

+

n Grafana, a user’s username and email address are unique fields, which + means no other user can have the same username or email address as another user. +

+

In addition, a user can have an email address as a username, and the Grafana + login allows users to sign in with either username or email address. This + creates an unusual behavior, where user_1 can register with one email + address and user_2 can register their username as user_1’s + email address. As a result, user_1 would be prevented from signing + in to Grafana, since user_1 password won’t match with user_2 + email address.

+

The CVSS score for this vulnerability is 4.3 moderate + (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L).

+
+ + + + CVE-2022-39229 + https://github.com/grafana/grafana/security/advisories/GHSA-gj7m-853r-289r + + + 2022-09-07 + 2022-11-12 + + + ipython -- Execution with Unnecessary Privileges