Bug 1216316 (CVE-2023-4399)

Summary:	VUL-0: CVE-2023-4399: grafana: Request security bypass
Product:	[Novell Products] SUSE Security Incidents	Reporter:	SMASH SMASH <smash_bz>
Component:	Incidents	Assignee:	monitoring-devel <monitoring-devel>
Status:	RESOLVED UPSTREAM	QA Contact:	Security Team bot <security-team>
Severity:	Normal
Priority:	P3 - Medium	CC:	gabriele.sonnu, witold.bedyk
Version:	unspecified
Target Milestone:	---
Hardware:	Other
OS:	Other
URL:	https://smash.suse.de/issue/382126/
Whiteboard:	CVSSv3.1:SUSE:CVE-2023-4399:6.6:(AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:N/A:L)
Found By:	Security Response Team	Services Priority:
Business Priority:		Blocker:	---
Marketing QA Status:	---	IT Deployment:	---

Description SMASH SMASH 2023-10-17 08:46:39 UTC

Grafana is an open-source platform for monitoring and observability. 

In Grafana Enterprise, Request security is a deny list that allows admins to configure Grafana in a way so that the instance doesn’t call specific hosts.

However, the restriction can be bypassed used punycode encoding of the characters in the request address.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-4399

Comment 2 Witek Bedyk 2023-10-17 10:02:20 UTC

It affects only Grafana Enterprise which we do not ship.

Comment 3 Gabriele Sonnu 2023-10-17 12:05:28 UTC

Thanks Witek,

SLE is not affected, closing.