Attachment 196707 Details for Bug 231020 – vuxml-grafana4.patch

[patch] vuxml-grafana4.patch

vuxml-grafana4.patch (text/plain), 1.85 KB, created by Dmitri Goutnik on 2018-08-30 13:13:12 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Dmitri Goutnik

Created: 2018-08-30 13:13:12 UTC

Size: 1.85 KB

patch

obsolete

>Index: security/vuxml/vuln.xml
>===================================================================
>--- security/vuxml/vuln.xml	(revision 478425)
>+++ security/vuxml/vuln.xml	(working copy)
>@@ -58,6 +58,41 @@
> * Do not forget port variants (linux-f10-libxml2, libxml2, etc.)
> -->
> <vuxml xmlns="http://www.vuxml.org/apps/vuxml-1">
>+ <vuln vid="66781312-ac54-11e8-9cb6-10c37b4ac2ea">
>+ <topic>grafana4 -- LDAP and OAuth login vulnerability</topic>
>+ <affects>
>+ <package>
>+	<name>grafana4</name>
>+	<range><ge>4.0.0</ge><lt>4.6.4</lt></range>
>+ </package>
>+ </affects>
>+ <description>
>+ <body xmlns="http://www.w3.org/1999/xhtml">
>+	Grafana Labs reports:
>+	<blockquote cite="https://community.grafana.com/t/grafana-5-2-3-and-4-6-4-security-update/10050">
>+	 On the 20th of August at 1800 CEST we were contacted about a
>+	 potential security issue with the âremember meâ cookie Grafana
>+	 sets upon login. The issue targeted users without a local Grafana
>+	 password (LDAP &amp; OAuth users) and enabled a potential attacker
>+	 to generate a valid cookie knowing only a username.
>+	 All installations which use the Grafana LDAP or OAuth
>+	 authentication features must be upgraded as soon as possible. If
>+	 you cannot upgrade, you should switch authentication mechanisms
>+	 or put additional protections in front of Grafana such as a
>+	 reverse proxy.
>+	</blockquote>
>+ </body>
>+ </description>
>+ <references>
>+ <url>https://community.grafana.com/t/grafana-5-2-3-and-4-6-4-security-update/10050</url>
>+ <cvename>CVE-2018-558213</cvename>
>+ </references>
>+ <dates>
>+ <discovery>2018-08-20</discovery>
>+ <entry>2018-08-30</entry>
>+ </dates>
>+ </vuln>
>+
> <vuln vid="0904e81f-a89d-11e8-afbb-bc5ff4f77b71">
> <topic>node.js -- multiple vulnerabilities</topic>
> <affects>

Flags:

dmgk: maintainer-approval?

Actions: View | Diff

Attachments on bug 231020: 196706 | 196707