Update Info

SUSE-SLE-Module-Packagehub-Subpackages-15-SP4-2023-821


Security update for grafana


Type: security
Severity: important
Issued: 2023-03-20
Description:
This update for grafana fixes the following issues:

- CVE-2022-23552: Fixed SVG processing by adding a dompurify preprocessor step (bsc#1207749).
- CVE-2022-39324: Fixed originalUrl spoof security issue (bsc#1207750).
- CVE-2022-41723: Fixed go issue to avoid quadratic complexity in HPACK decoding (bsc#1208293).
- CVE-2022-46146: Fixed basic authentication bypass by updating the exporter toolkit (bsc#1208065).
- Trim leading and trailing whitespaces from email and username on signup
- Fix invitation validation: Check whether the provided email address is the same as where the invitation is sent


              

Packages


  • grafana-8.5.20-150200.3.35.1