SUSE SLES15 / openSUSE 15 Security Update : grafana (SUSE-SU-2025:0545-1)

medium Nessus Plugin ID 216397

Language:

Synopsis

The remote SUSE host is missing one or more security updates.

Description

The remote SUSE Linux SLES15 / openSUSE 15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:0545-1 advisory.

grafana was updated from version 9.5.18 to 10.4.13 (jsc#PED-11591,jsc#PED-11649):

- Security issues fixed:
* CVE-2024-45337: Prevent possible misuse of ServerConfig.PublicKeyCallback by upgrading golang.org/x/crypto (bsc#1234554)
* CVE-2023-3128: Fixed authentication bypass using Azure AD OAuth (bsc#1212641)
* CVE-2023-6152: Add email verification when updating user email (bsc#1219912)
* CVE-2024-6837: Fixed potential data source permission escalation (bsc#1236301)
* CVE-2024-8118: Fixed permission on external alerting rule write endpoint (bsc#1231024)

- Potential breaking changes in version 10:
* In panels using the `extract fields` transformation, where one of the extracted names collides with one of the already existing ields, the extracted field will be renamed.
* For the existing backend mode users who have table visualization might see some inconsistencies on their panels.
We have updated the table column naming. This will potentially affect field transformations and/or field overrides. To resolve this either: update transformation or field override.
* For the existing backend mode users who have Transformations with the `time` field, might see their transformations are not working. Those panels that have broken transformations will fail to render. This is because we changed the field key. To resolve this either: Remove the affected panel and re-create it; Select the `Time` field again; Edit the `time` field as `Time` for transformation in `panel.json` or `dashboard.json`
* The following data source permission endpoints have been removed:
`GET /datasources/:datasourceId/permissions` `POST /api/datasources/:datasourceId/permissions` `DELETE /datasources/:datasourceId/permissions` `POST /datasources/:datasourceId/enable-permissions` `POST /datasources/:datasourceId/disable-permissions`
- Please use the following endpoints instead:
`GET /api/access-control/datasources/:uid` for listing data source permissions `POST /api/access-control/datasources/:uid/users/:id`, `POST /api/access-control/datasources/:uid/teams/:id` and `POST /api/access-control/datasources/:uid/buildInRoles/:id` for adding or removing data source permissions
* If you are using Terraform Grafana provider to manage data source permissions, you will need to upgrade your provider.
* For the existing backend mode users who have table visualization might see some inconsistencies on their panels.
We have updated the table column naming. This will potentially affect field transformations and/or field overrides.
* The deprecated `/playlists/{uid}/dashboards` API endpoint has been removed.
Dashboard information can be retrieved from the `/dashboard/...` APIs.
* The `PUT /api/folders/:uid` endpoint no more supports modifying the folder's `UID`
* Removed all components for the old panel header design.
* Please review https://grafana.com/docs/grafana/next/breaking-changes/breaking-changes-v10-3/ for more details
* OAuth role mapping enforcement: This change impacts GitHub, Gitlab, Okta, and Generic OAuth. To avoid overriding manually set roles, enable the skip_org_role_sync option in the Grafana configuration for your OAuth provider before upgrading
* Angular has been deprecated
* Grafana legacy alerting has been deprecated
* API keys are migrating to service accounts
* The experimental dashboard previews feature is removed
* Usernames are now case-insensitive by default
* Grafana OAuth integrations do not work anymore with email lookups
* The Alias field in the CloudWatch data source is removed
* Athena data source plugin must be updated to version >=2.9.3
* Redshift data source plugin must be updated to version >=1.8.3
* DoiT International BigQuery plugin no longer supported
* Please review https://grafana.com/docs/grafana/next/breaking-changes/breaking-changes-v10-0 for more details

- This update brings many new features, enhancements and fixes highlighted at:
* https://grafana.com/docs/grafana/next/whatsnew/whats-new-in-v10-4/
* https://grafana.com/docs/grafana/next/whatsnew/whats-new-in-v10-3/
* https://grafana.com/docs/grafana/next/whatsnew/whats-new-in-v10-2/
* https://grafana.com/docs/grafana/next/whatsnew/whats-new-in-v10-1/
* https://grafana.com/docs/grafana/next/whatsnew/whats-new-in-v10-0/

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update the affected grafana package.

Plugin Details

Severity: Medium

ID: 216397

File Name: suse_SU-2025-0545-1.nasl

Version: 1.2

Type: local

Agent: unix

Family: SuSE Local Security Checks

Published: 2/17/2025

Updated: 2/19/2025

Supported Sensors: Agentless Assessment, Continuous Assessment, Frictionless Assessment Agent, Frictionless Assessment AWS, Frictionless Assessment Azure, Nessus Agent, Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 6.7

CVSS v2

Risk Factor: Critical

Base Score: 10

Temporal Score: 7.8

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

CVSS Score Source: CVE-2023-3128

CVSS v3

Risk Factor: Critical

Base Score: 9.8

Temporal Score: 8.8

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

CVSS v4

Risk Factor: Medium

Base Score: 5.1

Threat Score: 2

Threat Vector: CVSS:4.0/E:P

Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

CVSS Score Source: CVE-2024-8118

Vulnerability Information

CPE: p-cpe:/a:novell:suse_linux:grafana, cpe:/o:novell:suse_linux:15

Required KB Items: Host/local_checks_enabled, Host/cpu, Host/SuSE/release, Host/SuSE/rpm-list

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 2/14/2025

Vulnerability Publication Date: 6/22/2023

Reference Information

CVE: CVE-2023-3128, CVE-2023-6152, CVE-2024-45337, CVE-2024-6837, CVE-2024-8118

IAVB: 2023-B-0044-S, 2024-B-0012-S, 2024-B-0142-S, 2025-B-0016

SuSE: SUSE-SU-2025:0545-1

Detections

Analytics