RedHat: RHSA-2019-0019:01 Moderate: grafana security and bug fix update
Summary
The grafana package provides the Grafana metrics dashboard and graph
editor.
Security Fix(es):
* grafana: authentication bypass knowing only a username of an LDAP or
OAuth user (CVE-2018-15727)
For more details about the security issue(s), including the impact, a CVSS
score, and other related information, refer to the CVE page(s) listed in
the References section.
Bug Fix(es):
* The grafana package has been upgraded to upstream version 5.2.4., which
includes a number of bug fixes (BZ#1647494)
* Shrinking the cluster size no longer causes the Red Hat Ceph Storage
Dashboard to display the error message Templating init failed (BZ#1653273)
Summary
Solution
For details on how to apply this update, which includes the changes
described in this advisory, refer to:
https://access.redhat.com/articles/11258
References
https://access.redhat.com/security/cve/CVE-2018-15727 https://access.redhat.com/security/updates/classification/#moderate
Package List
Red Hat Ceph Storage 3.2 Tools:
Source:
grafana-5.2.4-1.el7cp.src.rpm
x86_64:
grafana-5.2.4-1.el7cp.x86_64.rpm
These packages are GPG signed by Red Hat for security. Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/
Topic
The updated grafana package is now available for Red Hat Ceph Storage 3.2.Red Hat Product Security has rated this update as having a security impactof Moderate. A Common Vulnerability Scoring System (CVSS) base score, whichgives a detailed severity rating, is available for each vulnerability fromthe CVE link(s) in the References section.
Topic
Relevant Releases Architectures
Red Hat Ceph Storage 3.2 Tools - x86_64
Bugs Fixed
1624088 - CVE-2018-15727 grafana: authentication bypass knowing only a username of an LDAP or OAuth user
1633825 - Add ceph FS support in ceph metrics
1647494 - Update grafana to latest for security fixes
1647496 - Remove golang dependency from grafana
1652427 - [ceph-metrics]Change password is not working
1653273 - Metrics dashboard is throwing "Templating init failed" error after rerunning metrics playbook