Detections
Analytics
Rocky Linux 9 : grafana (RLSA-2024:2568)
medium Nessus Plugin ID 196966
Synopsis
The remote Rocky Linux host is missing one or more security updates.Description
The remote Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2024:2568 advisory.- It is possible for a user in a different organization from the owner of a snapshot to bypass authorization and delete a snapshot by issuing a DELETE request to /api/snapshots/<key> using its view key. This functionality is intended to only be available to individuals with the permission to write/edit to the snapshot in question, but due to a bug in the authorization logic, deletion requests issued by an unprivileged user in a different organization than the snapshot owner are treated as authorized. Grafana Labs would like to thank Ravid Mazon and Jay Chen of Palo Alto Research for discovering and disclosing this vulnerability. This issue affects Grafana: from 9.5.0 before 9.5.18, from 10.0.0 before 10.0.13, from 10.1.0 before 10.1.9, from 10.2.0 before 10.2.6, from 10.3.0 before 10.3.5. (CVE-2024-1313)
- A memory leak flaw was found in Golang in the RSA encrypting/decrypting code, which might lead to a resource exhaustion vulnerability using attacker-controlled inputs. The memory leak happens in github.com/golang-fips/openssl/openssl/rsa.go#L113. The objects leaked are pkey and ctx. That function uses named return parameters to free pkey and ctx if there is an error initializing the context or setting the different properties. All return statements related to error cases follow the return nil, nil, fail(...) pattern, meaning that pkey and ctx will be nil inside the deferred function that should free them. (CVE-2024-1394)
Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.
Solution
Update the affected packages.See Also
https://errata.rockylinux.org/RLSA-2024:2568
Plugin Details
Severity: Medium
ID: 196966
File Name: rocky_linux_RLSA-2024-2568.nasl
Version: 1.1
Type: local
Published: 5/14/2024
Updated: 10/4/2024
Supported Sensors: Nessus
Risk Information
VPR
Risk Factor: Medium
Score: 4.4
CVSS v2
Risk Factor: Medium
Base Score: 6.8
Temporal Score: 5
Vector: CVSS2#AV:N/AC:L/Au:S/C:N/I:C/A:N
CVSS Score Source: CVE-2024-1313
CVSS v3
Risk Factor: Medium
Base Score: 6.5
Temporal Score: 5.7
Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C
Vulnerability Information
CPE: p-cpe:/a:rocky:linux:grafana-selinux, p-cpe:/a:rocky:linux:grafana-debugsource, cpe:/o:rocky:linux:9, p-cpe:/a:rocky:linux:grafana, p-cpe:/a:rocky:linux:grafana-debuginfo
Required KB Items: Host/local_checks_enabled, Host/cpu, Host/RockyLinux/release, Host/RockyLinux/rpm-list
Exploit Ease: No known exploits are available
Patch Publication Date: 5/10/2024
Vulnerability Publication Date: 3/21/2024
Reference Information
CVE: CVE-2024-1313, CVE-2024-1394
IAVB: 2024-B-0035-S