Bugzilla – Bug 1219912
VUL-0: CVE-2023-6152: grafana: lack of validation on email update on configuration option "verify_email_enabled"
Last modified: 2024-06-24 20:32:35 UTC
A user changing their email after signing up and verifying it can change it without verification in profile settings. The configuration option "verify_email_enabled" will only validate email only on sign up. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-6152 https://www.cve.org/CVERecord?id=CVE-2023-6152 https://github.com/grafana/bugbounty/security/advisories/GHSA-3hv4-r2fm-h27f https://grafana.com/security/security-advisories/cve-2023-6152/ Patch: https://github.com/grafana/grafana/commit/37ba9d7db1359c6dc3b6498c0c345d1a9eb3f6b7
Tracking as affected: - SUSE:SLE-12:Update/grafana 9.5.8 - SUSE:SLE-12:Update:Products:ManagerToolsBeta:Update/grafana 9.5.8 - SUSE:SLE-15-SP2:Update/grafana 9.5.8 - SUSE:SLE-15:Update/grafana 9.5.8 - SUSE:SLE-15:Update:Products:ManagerToolsBeta:Update/grafana 9.5.8 - openSUSE:Factory/grafana 10.1.5 CVSS 7 so won't fix for: - SUSE:SLE-12-SP3:Update:Products:Cloud8:Update/grafana 6.7.4 - SUSE:SLE-12-SP4:Update:Products:Cloud9:Update/grafana 6.7.4
Grafana in openSUSE:Factory had been meanwhile upgraded to the patched version 10.3.3. Submission adding CVE and Bugzilla reference has been requested: https://build.opensuse.org/request/show/1156920
SUMA development IBS projects have been updated to the patched version 9.5.16. Submissions to the SLE15 and SLE12 codestreams are planned together with the next SUMA maintenance update on April 18.
SUSE-SU-2024:1427-1: An update that solves eight vulnerabilities, contains one feature and has 11 security fixes can now be installed. Category: security (moderate) Bug References: 1008037, 1008038, 1010940, 1019021, 1038785, 1059235, 1099805, 1166389, 1171823, 1174145, 1174302, 1175993, 1177948, 1216854, 1219002, 1219887, 1219912, 1220371, 1221092 CVE References: CVE-2016-8647, CVE-2016-9587, CVE-2017-7550, CVE-2018-10874, CVE-2020-14365, CVE-2023-5764, CVE-2023-6152, CVE-2024-0690 Jira References: MSQA-759 Maintenance Incident: [SUSE:Maintenance:33400](https://smelt.suse.de/incident/33400/) Sources used: SUSE Manager Client Tools Beta for SLE 15 (src): ansible-2.9.27-159000.3.12.2, spacecmd-5.0.5-159000.6.48.2, grafana-9.5.16-159000.4.30.2, supportutils-plugin-susemanager-client-5.0.3-159000.6.21.2, uyuni-tools-0.1.7-159000.3.8.1, POS_Image-Graphical7-0.1.1710765237.46af599-159000.3.24.2, dracut-saltboot-0.1.1710765237.46af599-159000.3.33.2, spacewalk-client-tools-5.0.4-159000.6.54.2, POS_Image-JeOS7-0.1.1710765237.46af599-159000.3.24.2 SUSE Manager Client Tools Beta for SLE Micro 5 (src): golang-github-prometheus-node_exporter-1.5.0-159000.6.2.1, uyuni-tools-0.1.7-159000.3.8.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
SUSE-SU-2024:1419-1: An update that solves one vulnerability, contains three features and has two security fixes can now be installed. Category: security (moderate) Bug References: 1219887, 1219912, 1220371 CVE References: CVE-2023-6152 Jira References: MSQA-759, PED-7893, PED-7928 Maintenance Incident: [SUSE:Maintenance:33381](https://smelt.suse.de/incident/33381/) Sources used: SUSE Manager Client Tools Beta for SLE 12 (src): spacecmd-5.0.5-41.48.1, golang-github-prometheus-alertmanager-0.26.0-4.18.2, golang-github-prometheus-node_exporter-1.7.0-4.18.2, grafana-9.5.16-4.27.1, spacewalk-client-tools-5.0.4-55.51.1, supportutils-plugin-susemanager-client-5.0.3-9.21.1, golang-github-prometheus-promu-0.14.0-4.15.1, uyuni-tools-0.1.7-3.8.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
SUSE-SU-2024:1530-1: An update that solves two vulnerabilities and contains one feature can now be installed. Category: security (moderate) Bug References: 1219912, 1222155 CVE References: CVE-2023-6152, CVE-2024-1313 Jira References: MSQA-760 Maintenance Incident: [SUSE:Maintenance:33419](https://smelt.suse.de/incident/33419/) Sources used: SUSE Package Hub 15 15-SP5 (src): grafana-9.5.18-150200.3.56.1 openSUSE Leap 15.5 (src): mybatis-3.5.6-150200.5.6.1, grafana-9.5.18-150200.3.56.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
SUSE-SU-2024:1509-1: An update that solves 15 vulnerabilities, contains one feature and has four security fixes can now be installed. Category: security (important) Bug References: 1008037, 1008038, 1010940, 1019021, 1038785, 1059235, 1099805, 1166389, 1171823, 1174145, 1174302, 1175993, 1177948, 1216854, 1219002, 1219912, 1221092, 1221465, 1222155 CVE References: CVE-2016-8614, CVE-2016-8628, CVE-2016-8647, CVE-2016-9587, CVE-2017-7550, CVE-2018-10874, CVE-2020-10744, CVE-2020-14330, CVE-2020-14332, CVE-2020-14365, CVE-2020-1753, CVE-2023-5764, CVE-2023-6152, CVE-2024-0690, CVE-2024-1313 Jira References: MSQA-760 Maintenance Incident: [SUSE:Maintenance:33434](https://smelt.suse.de/incident/33434/) Sources used: openSUSE Leap 15.5 (src): spacecmd-4.3.27-150000.3.116.2, POS_Image-JeOS7-0.1.1710765237.46af599-150000.1.21.2, ansible-2.9.27-150000.1.17.2, POS_Image-Graphical7-0.1.1710765237.46af599-150000.1.21.2, dracut-saltboot-0.1.1710765237.46af599-150000.1.53.2, golang-github-prometheus-promu-0.14.0-150000.3.18.2 SUSE Manager Client Tools for SLE 15 (src): POS_Image-JeOS7-0.1.1710765237.46af599-150000.1.21.2, ansible-2.9.27-150000.1.17.2, spacewalk-client-tools-4.3.19-150000.3.89.2, uyuni-common-libs-4.3.10-150000.1.39.2, uyuni-proxy-systemd-services-4.3.12-150000.1.21.2, mgr-daemon-4.3.9-150000.1.47.2, spacewalk-koan-4.3.6-150000.3.33.2, spacecmd-4.3.27-150000.3.116.2, POS_Image-Graphical7-0.1.1710765237.46af599-150000.1.21.2, dracut-saltboot-0.1.1710765237.46af599-150000.1.53.2, grafana-9.5.18-150000.1.63.2 SUSE Manager Client Tools for SLE Micro 5 (src): uyuni-proxy-systemd-services-4.3.12-150000.1.21.2, dracut-saltboot-0.1.1710765237.46af599-150000.1.53.2 SUSE Package Hub 15 15-SP5 (src): golang-github-prometheus-promu-0.14.0-150000.3.18.2 SUSE Manager Proxy 4.3 Module 4.3 (src): ansible-2.9.27-150000.1.17.2, uyuni-proxy-systemd-services-4.3.12-150000.1.21.2 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
SUSE-SU-2024:1508-1: An update that solves two vulnerabilities, contains three features and has one security fix can now be installed. Category: security (moderate) Bug References: 1219912, 1221465, 1222155 CVE References: CVE-2023-6152, CVE-2024-1313 Jira References: MSQA-760, PED-7893, PED-7928 Maintenance Incident: [SUSE:Maintenance:33420](https://smelt.suse.de/incident/33420/) Sources used: SUSE Manager Client Tools for SLE 12 (src): golang-github-prometheus-promu-0.14.0-1.18.1, spacecmd-4.3.27-38.139.1, spacewalk-client-tools-4.3.19-52.98.1, uyuni-common-libs-4.3.10-1.39.1, golang-github-prometheus-node_exporter-1.7.0-1.30.2, spacewalk-koan-4.3.6-24.36.1, golang-github-prometheus-alertmanager-0.26.0-1.27.2, mgr-daemon-4.3.9-1.47.1, grafana-9.5.18-1.63.1 SUSE Linux Enterprise High Performance Computing 12 SP5 (src): golang-github-prometheus-node_exporter-1.7.0-1.30.2 SUSE Linux Enterprise Server 12 SP5 (src): golang-github-prometheus-node_exporter-1.7.0-1.30.2 SUSE Linux Enterprise Server for SAP Applications 12 SP5 (src): golang-github-prometheus-node_exporter-1.7.0-1.30.2 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
SUSE-SU-2024:1530-2: An update that solves two vulnerabilities and contains one feature can now be installed. Category: security (moderate) Bug References: 1219912, 1222155 CVE References: CVE-2023-6152, CVE-2024-1313 Jira References: MSQA-760 Maintenance Incident: [SUSE:Maintenance:33419](https://smelt.suse.de/incident/33419/) Sources used: openSUSE Leap 15.6 (src): grafana-9.5.18-150200.3.56.1, mybatis-3.5.6-150200.5.6.1 SUSE Package Hub 15 15-SP6 (src): grafana-9.5.18-150200.3.56.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.