Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

Grafana for Linux: Unauthenticated Remote Code Execution

published 1 year ago

Summary

An update is available for Grafana on Linux systems. This update fixes a security issue that could allow an attacker to execute code on the system without needing a password. To stay secure, update your Grafana installation as soon as possible.

What to do

Update redhat grafana to version 0:10.2.6-4.el9.
Update redhat grafana-debuginfo to version 0:10.2.6-4.el9.
Update redhat grafana-debugsource to version 0:10.2.6-4.el9.
Update redhat grafana-selinux to version 0:10.2.6-4.el9.

Affected software

Ecosystem	Vendor	Product	Affected versions
Red Hat:enterprise_linux:9::appstream	redhat	grafana	< 0:10.2.6-4.el9 Fix: upgrade to 0:10.2.6-4.el9
Red Hat:enterprise_linux:9::appstream	redhat	grafana-debuginfo	< 0:10.2.6-4.el9 Fix: upgrade to 0:10.2.6-4.el9
Red Hat:enterprise_linux:9::appstream	redhat	grafana-debugsource	< 0:10.2.6-4.el9 Fix: upgrade to 0:10.2.6-4.el9
Red Hat:enterprise_linux:9::appstream	redhat	grafana-selinux	< 0:10.2.6-4.el9 Fix: upgrade to 0:10.2.6-4.el9

Original advisory text

Red Hat Security Advisory: grafana security update

References

https://access.redhat.com/errata/RHSA-2024:9115 Vendor Advisory
https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/9/html/9.5_rel... Third Party Advisory
https://access.redhat.com/security/updates/classification/#moderate Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2279814 Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2292668 Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2292787 Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2294000 Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2295310 Third Party Advisory
https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_9115.j... Vendor Advisory
https://access.redhat.com/security/cve/CVE-2024-6104 Third Party Advisory
https://www.cve.org/CVERecord?id=CVE-2024-6104 Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2024-6104 Vendor Advisory
https://access.redhat.com/security/cve/CVE-2024-24788 Third Party Advisory
https://www.cve.org/CVERecord?id=CVE-2024-24788 Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2024-24788 Vendor Advisory
https://pkg.go.dev/vuln/GO-2024-2824 Vendor Advisory
https://access.redhat.com/security/cve/CVE-2024-24789 Third Party Advisory
https://www.cve.org/CVERecord?id=CVE-2024-24789 Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2024-24789 Vendor Advisory
https://access.redhat.com/security/cve/CVE-2024-24790 Third Party Advisory
https://www.cve.org/CVERecord?id=CVE-2024-24790 Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2024-24790 Vendor Advisory
https://access.redhat.com/security/cve/CVE-2024-24791 Third Party Advisory
https://www.cve.org/CVERecord?id=CVE-2024-24791 Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2024-24791 Vendor Advisory
https://go.dev/cl/591255 Third Party Advisory
https://go.dev/issue/67555 Third Party Advisory
https://groups.google.com/g/golang-dev/c/t0rK-qHBqzY/m/6MMoAZkMAgAJ Third Party Advisory

Fix within

Internet-facing 14 days

Internal 60 days

Not known to be exploited
Can be exploited automatically (estimated)
Gives an attacker partial control (estimated)

Severity

7.5 High

Timeline

Published15 Nov 2024

Updated6 Mar 2026

First seen6 Mar 2026

Sources

RHSA-2024:9115 · OSV

Track software like this

Free during beta