SUSE-SU-2023:2916-1

    Dashboard / Vulnerabilities / SUSE-SU-2023:2916-1

    SUSE-SU-2023:2916-1

    Published: 20 Jul 2023Last Modified: 4 Feb 2026

    Summary: Security update for grafana

    Details: This update fixes the following issues: grafana: - Update to version 9.5.5: * CVE-2023-3128: Fix authentication bypass using Azure AD OAuth (bsc#1212641, jsc#PED-3694) * Bug fixes: * Auth: Show invite button if disable login form is set to false. * Azure: Fix Kusto auto-completion for Azure datasources. * RBAC: Remove legacy AC editor and admin role on new dashboard route. * API: Revert allowing editors to access GET /datasources. * Settings: Add ability to override skip_org_role_sync with Env variables. - Update to version 9.5.3: * CVE-2023-2801: Query: Prevent crash while executing concurrent mixed queries (bsc#1212099) * CVE-2023-2183: Alerting: Require alert.notifications:write permissions to test receivers and templates (bsc#1212100) - Update to version 9.5.2: Alerting: Scheduler use rule fingerprint instead of version. Explore: Update table min height. DataLinks: Encoded URL fixed. TimeSeries: Fix leading null-fill for missing intervals. Dashboard: Revert fixed header shown on mobile devices in the new panel header. PostgreSQL: Fix TLS certificate issue by downgrading lib/pq. Provisioning: Fix provisioning issues with legacy alerting and data source permissions. Alerting: Fix misleading status code in provisioning API. Loki: Fix log samples using `instant` queries. Panel Header: Implement new Panel Header on Angular Panels. Azure Monitor: Fix bug that was not showing resources for certain locations. Alerting: Fix panic when reparenting receivers to groups following an attempted rename via Provisioning. Cloudwatch Logs: Clarify Cloudwatch Logs Limits. - Update to 9.5.1 Loki Variable Query Editor: Fix bug when the query is updated Expressions: Fix expression load with legacy UID -100

    References: https://www.suse.com/support/update/announcement/2023/suse-su-20232916-1/, https://bugzilla.suse.com/1212099, https://bugzilla.suse.com/1212100, https://bugzilla.suse.com/1212641, https://www.suse.com/security/cve/CVE-2023-2183, https://www.suse.com/security/cve/CVE-2023-2801, https://www.suse.com/security/cve/CVE-2023-3128

    Affected packages

    Package

    Name: grafana

    Purl: pkg:rpm/suse/grafana&distro=SUSE%20Manager%20Client%20Tools%2012

    Affected ranges

    Type: ECOSYSTEM

    Events:

    Introduced- 0
    Fixed -9.5.5-1.51.1

    Affected versions

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    SUSE-SU-2023:2916-1 | CVE-DB