Executive Summary

Titlegrafana security and bug fix update
NameRHSA-2019:0019First vendor Publication2019-01-03
VendorRedHatLast vendor Modification2019-01-03
Severity (Vendor) N/ARevision01

Security-Database Scoring CVSS v2

Cvss vector : (AV:N/AC:L/Au:N/C:P/I:P/A:P)
Cvss Base Score7.5Attack RangeNetwork
Cvss Impact Score6.4Attack ComplexityLow
Cvss Expoit Score10AuthenticationNone Required
Calculate full CVSS 2.0 Vectors scores


Problem Description:

The updated grafana package is now available for Red Hat Ceph Storage 3.2.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

2. Relevant releases/architectures:

Red Hat Ceph Storage 3.2 Tools - x86_64

3. Description:

The grafana package provides the Grafana metrics dashboard and graph editor.

Security Fix(es):

* grafana: authentication bypass knowing only a username of an LDAP or OAuth user (CVE-2018-15727)

For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es):

* The grafana package has been upgraded to upstream version 5.2.4., which includes a number of bug fixes (BZ#1647494)

* Shrinking the cluster size no longer causes the Red Hat Ceph Storage Dashboard to display the error message Templating init failed (BZ#1653273)

4. Solution:

For details on how to apply this update, which includes the changes described in this advisory, refer to:


5. Bugs fixed (https://bugzilla.redhat.com/):

1624088 - CVE-2018-15727 grafana: authentication bypass knowing only a username of an LDAP or OAuth user 1633825 - Add ceph FS support in ceph metrics 1647494 - Update grafana to latest for security fixes 1647496 - Remove golang dependency from grafana 1652427 - [ceph-metrics]Change password is not working 1653273 - Metrics dashboard is throwing "Templating init failed" error after rerunning metrics playbook

Original Source

Url : https://rhn.redhat.com/errata/RHSA-2019-0019.html

CWE : Common Weakness Enumeration

100 %CWE-287Improper Authentication

CPE : Common Platform Enumeration


Alert History

If you want to see full details history, please login or register.
2019-01-08 00:18:52
  • First insertion