From nobody Thu Sep 01 12:01:13 2022 X-Original-To: dev-commits-ports-main@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4MJKQ224VLz4bQWx; Thu, 1 Sep 2022 12:01:14 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "R3" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4MJKQ21fkKz3vbv; Thu, 1 Sep 2022 12:01:14 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1662033674; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=0MeYnwLVVlQW/Z7bppsDsgWHXBLxUGMMBqNdQ7T6qlw=; b=OgEyjqeh9z9yqMfySrhu8pRnyk2FW1rNz86ZBA0JcI9YkYSPBy8UGJBKHsu3N9Fgz54XG6 8ExdiVlzbCU/g0NeYTrsg3c1zy7pcl4x2GDj/ErDik6PVjkl6F+I0aa9Hx86xdDb+JdhIO tT6nTvH9s1QQv9LnPOFDT+BoI4RwkJcMYDiWoHEjYxd+pkESV9j4XxRmzukgJNAv3HGsq7 xmnzhb9mfpg/NYtTX20q62Woch5kyQkiACS5AtHNqMg6NVKLqOvG7FmWrNJlE/PlFs2B/K Cyvs1vqiG72K/SAGJ6HY7cBYeMtUn4PZ8QrUe3bdLkXOnaqyNIj6Ossr1x6GTw== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id 4MJKQ20RzkzSHp; Thu, 1 Sep 2022 12:01:14 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from gitrepo.freebsd.org ([127.0.1.44]) by gitrepo.freebsd.org (8.16.1/8.16.1) with ESMTP id 281C1Dk3020264; Thu, 1 Sep 2022 12:01:13 GMT (envelope-from git@gitrepo.freebsd.org) Received: (from git@localhost) by gitrepo.freebsd.org (8.16.1/8.16.1/Submit) id 281C1Dr4020263; Thu, 1 Sep 2022 12:01:13 GMT (envelope-from git) Date: Thu, 1 Sep 2022 12:01:13 GMT Message-Id: <202209011201.281C1Dr4020263@gitrepo.freebsd.org> To: ports-committers@FreeBSD.org, dev-commits-ports-all@FreeBSD.org, dev-commits-ports-main@FreeBSD.org From: Nuno Teixeira Subject: git: 4c5b10193058 - main - security/vuxml: Document Grafana vulnerabilities List-Id: Commits to the main branch of the FreeBSD ports repository List-Archive: https://lists.freebsd.org/archives/dev-commits-ports-main List-Help: List-Post: List-Subscribe: List-Unsubscribe: Sender: owner-dev-commits-ports-main@freebsd.org X-BeenThere: dev-commits-ports-main@freebsd.org MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: eduardo X-Git-Repository: ports X-Git-Refname: refs/heads/main X-Git-Reftype: branch X-Git-Commit: 4c5b101930584d59822335a4a7cf82ae17096c5a Auto-Submitted: auto-generated ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1662033674; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=0MeYnwLVVlQW/Z7bppsDsgWHXBLxUGMMBqNdQ7T6qlw=; b=tTM1WoEE3XhyTdRpZWfnjA7U5LRKL5utl9srMUYirKDGi2aBQXwkP2cfY4jag7LoibNJx8 FHoXpmxeY35l0Jp6k8kUsmeKfO5HZ/uJlRWxQbxsmpQeMJpeXjb5WShTlC2n8nEtKqiIEt ulXSSOtCmp4dK5ND6k/gkuiTXjJ0F3xBOpZLDAtBuLBnjb5s+qQaHSI4wuFIMCFtNrQn5E M4NqtNsZUlhcw7+xl6CXuR/cN/BG4p4uaSqSPUZAnv5PbnLugaOvH1wLkgjjn2+NjIl2tT Rr/B9FWObub8imHJ4NAALC1HEFp3YEyA8eGqb0D7gHgT/MV9l5Qp9C2vkjgosw== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1662033674; a=rsa-sha256; cv=none; b=NVk0RPVq3uOcCrSJyxI87USSuLE+iw5HhCqkKCYIcVmRdkz+j6CscVqMJtSu6KNGBv/K2w 1IxEIP7AWKdW5hneRb3u5/gtXQW/SVW81I5KHQgBcmIf/02bhZM9F/8Nhwak+PcHrLQ2NH VBISlQe770TbaJ1Lyjalqf0LL/EFvZAV4t8us3dh3iFvsW25IpoQ9ni3EiyJ6YN9vxb611 kZWG1hhu0wm8K9fVN1CE2pK8AB0rOWdMTufh7/V3BnkoX9q3WdcaQUmC0CE8S1DiaAdX9q LskOY05aW5vl9UfK/xULjPN4OONQ36qOFP4ELsi2OjZ2ZZ/1PGIzDlwctp5OMA== ARC-Authentication-Results: i=1; mx1.freebsd.org; none X-ThisMailContainsUnwantedMimeParts: N The branch main has been updated by eduardo: URL: https://cgit.FreeBSD.org/ports/commit/?id=4c5b101930584d59822335a4a7cf82ae17096c5a commit 4c5b101930584d59822335a4a7cf82ae17096c5a Author: Nuno Teixeira AuthorDate: 2022-09-01 09:20:35 +0000 Commit: Nuno Teixeira CommitDate: 2022-09-01 12:00:54 +0000 security/vuxml: Document Grafana vulnerabilities - vuxml: CVE-2022-31176 - Unauthorized file disclosure PR: 266128 --- security/vuxml/vuln-2022.xml | 45 ++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 45 insertions(+) diff --git a/security/vuxml/vuln-2022.xml b/security/vuxml/vuln-2022.xml index 0248ee9e5271..9a9a8cea1593 100644 --- a/security/vuxml/vuln-2022.xml +++ b/security/vuxml/vuln-2022.xml @@ -1,3 +1,48 @@ + + Grafana -- Unauthorized file disclosure + + + grafana + 5.2.08.3.11 + 8.4.08.4.11 + 8.5.08.5.11 + 9.0.09.0.8 + 9.1.09.1.2 + + + grafana7 + 7.0 + + + grafana8 + 8.3.08.3.11 + 8.4.08.4.11 + 8.5.08.5.11 + + + grafana9 + 9.0.09.0.8 + 9.1.09.1.2 + + + + +

Grafana Labs reports:

+
+

On July 21, an internal security review identified an unauthorized file disclosure vulnerability in the Grafana Image Renderer plugin when HTTP remote rendering is used. The Chromium browser embedded in the Grafana Image Renderer allows for “printing” of unauthorized files in a PNG file. This makes it possible for a malicious user to retrieve unauthorized files under some network conditions or via a fake data source (this applies if the user has admin permissions in Grafana).

+
+ + + + CVE-2022-31176 + https://github.com/grafana/grafana-image-renderer/security/advisories/GHSA-2cfh-233g-m4c5 + + + 2022-07-21 + 2022-09-01 + + + Matrix clients -- several vulnerabilities