Detections
Analytics

SUSE SLES15 / openSUSE 15 Security Update : grafana and mybatis (SUSE-SU-2024:1530-2)

medium Nessus Plugin ID 200928

Language:

Synopsis

The remote SUSE host is missing one or more security updates.

Description

The remote SUSE Linux SLES15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:1530-2 advisory.

 grafana was updated to version 9.5.18:

 - Grafana now requires Go 1.20
 - Security issues fixed:

 * CVE-2024-1313: Require same organisation when deleting snapshots (bsc#1222155)
 * CVE-2023-6152: Add email verification when updating user email (bsc#1219912)

 - Other non-security related changes:

 * Version 9.5.17:

 + [FEATURE] Alerting: Backport use Alertmanager API v2

 * Version 9.5.16:

 + [BUGFIX] Annotations: Split cleanup into separate queries and deletes to avoid deadlocks on MySQL

 * Version 9.5.15:

 + [FEATURE] Alerting: Attempt to retry retryable errors

 * Version 9.5.14:

 + [BUGFIX] Alerting: Fix state manager to not keep datasource_uid and ref_id labels in state after Error + [BUGFIX] Transformations: Config overrides being lost when config from query transform is applied + [BUGFIX] LDAP: Fix enable users on successfull login

 * Version 9.5.13:

 + [BUGFIX] BrowseDashboards: Only remember the most recent expanded folder + [BUGFIX] Licensing: Pass func to update env variables when starting plugin

 * Version 9.5.12:

 + [FEATURE] Azure: Add support for Workload Identity authentication

 * Version 9.5.9:

 + [FEATURE] SSE: Fix DSNode to not panic when response has empty response + [FEATURE] Prometheus: Handle the response with different field key order + [BUGFIX] LDAP: Fix user disabling


 mybatis:

 - `apache-commons-ognl` is now a non-optional dependency
 - Fixed building with log4j v1 and v2 dependencies

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update the affected grafana, mybatis and / or mybatis-javadoc packages.

See Also

https://bugzilla.suse.com/1219912

https://bugzilla.suse.com/1222155

https://lists.suse.com/pipermail/sle-updates/2024-June/035719.html

https://www.suse.com/security/cve/CVE-2023-6152

https://www.suse.com/security/cve/CVE-2024-1313

Plugin Details

Severity: Medium

ID: 200928

File Name: suse_SU-2024-1530-2.nasl

Version: 1.1

Type: local

Agent: unix

Published: 6/25/2024

Updated: 6/25/2024

Supported Sensors: Agentless Assessment, Frictionless Assessment Agent, Frictionless Assessment AWS, Frictionless Assessment Azure, Nessus Agent, Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 4.4

CVSS v2

Risk Factor: Medium

Base Score: 6.8

Temporal Score: 5

Vector: CVSS2#AV:N/AC:L/Au:S/C:N/I:C/A:N

CVSS Score Source: CVE-2024-1313

CVSS v3

Risk Factor: Medium

Base Score: 6.5

Temporal Score: 5.7

Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

CPE: p-cpe:/a:novell:suse_linux:grafana, cpe:/o:novell:suse_linux:15

Required KB Items: Host/local_checks_enabled, Host/cpu, Host/SuSE/release, Host/SuSE/rpm-list

Exploit Ease: No known exploits are available

Patch Publication Date: 6/24/2024

Vulnerability Publication Date: 2/13/2024

Reference Information

CVE: CVE-2023-6152, CVE-2024-1313

IAVB: 2024-B-0012-S, 2024-B-0035

SuSE: SUSE-SU-2024:1530-2