1193492 – (CVE-2021-43798) VUL-0: CVE-2021-43798: grafana: arbitrary file read in the graph native plugin

Bug 1193492 (CVE-2021-43798) - VUL-0: CVE-2021-43798: grafana: arbitrary file read in the graph native plugin

Summary: VUL-0: CVE-2021-43798: grafana: arbitrary file read in the graph native plugin

Status:	RESOLVED INVALID

Alias:	CVE-2021-43798

Product:	SUSE Security Incidents
Classification:	Novell Products
Component:	Incidents (show other bugs)
Version:	unspecified
Hardware:	Other Other

Priority:	P2 - High Severity: Major
Target Milestone:	---
Assignee:	Security Team bot
QA Contact:	Security Team bot

URL:
Whiteboard:	CVSSv3.1:SUSE:CVE-2021-43798:7.5:(AV:...
Keywords:

Depends on:
Blocks:

Clone This Bug

Reported:	2021-12-07 16:53 UTC by Thomas Leroy
Modified:	2025-02-25 13:04 UTC (History)
CC List:	2 users (show)

See Also:
Found By:	---
Services Priority:
Business Priority:
Blocker:	---
Marketing QA Status:	---
IT Deployment:	---

Attachments
Screenshot of a poc (371.59 KB, image/jpeg) 2021-12-07 16:53 UTC, Thomas Leroy	Details
View All Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.

Description Thomas Leroy 2021-12-07 16:53:27 UTC

Created attachment 854380 [details]
Screenshot of a poc

An arbitrary file read has been dropped on Twitter on 2021-12-04. For the moment, no upstream fix is given.

A quick analysis of the code make the vuln probable, but we should monitor for acknowledgement from Grafana dev team, as well as a fix.

Probable vulnerable code is in getPluginAssets method, in grafana/blob/main/pkg/api/plugins.go:284.

References:
https://github.com/grafana/grafana/blob/a2ad0a0fb61b969ecf31b6cc9df3964cccf3e313/pkg/api/plugins.go#L284

Comment 1 Marcus Meissner 2021-12-08 08:36:30 UTC

https://grafana.com/blog/2021/12/07/grafana-8.3.1-8.2.7-8.1.8-and-8.0.7-released-with-high-severity-security-fix/

Comment 2 Thomas Leroy 2021-12-08 15:46:28 UTC

Upstream fix commit:
https://github.com/grafana/grafana/commit/c798c0e958d15d9cc7f27c72113d572fa58545ce

Security advisory:
https://github.com/grafana/grafana/security/advisories/GHSA-8pjx-jj86-j47p

Comment 3 Thomas Leroy 2021-12-08 16:27:59 UTC

The vulnerable commit [0] has been introduced in v8.0.0. But every version that we ship is <7.5.11. Moreover, I checked that the vulnerable commit has not been backported. Therefore, I think we are not affected.
In light of the importance this vulnerability seems to take, that would be great if someone can double-check my assessment.

[0] https://github.com/grafana/grafana/commit/c37a3bebb7b5eb3a0bee5ffb26798282f0abead0

Comment 4 Christian Almeida de Oliveira 2021-12-09 15:31:21 UTC

Cloud 8 and Cloud 9 use both version 6.7.4, thus not impacted.
Back to Security team.

Comment 5 Thomas Leroy 2021-12-13 08:21:39 UTC

Thanks Christian for confirming. Closing since we are not affected.

Comment 8 Swamp Workflow Management 2022-10-20 16:22:45 UTC

SUSE-SU-2022:3676-1: An update that fixes 14 vulnerabilities, contains four features is now available.

Category: security (important)
Bug References: 1188571,1189520,1192383,1192763,1193492,1193686,1194873,1195726,1195727,1195728,1201535,1201539,1203596,1203597
CVE References: CVE-2021-36222,CVE-2021-3711,CVE-2021-41174,CVE-2021-41244,CVE-2021-43798,CVE-2021-43815,CVE-2022-21673,CVE-2022-21702,CVE-2022-21703,CVE-2022-21713,CVE-2022-31097,CVE-2022-31107,CVE-2022-35957,CVE-2022-36062
JIRA References: PED-2145,SLE-23422,SLE-23439,SLE-24565
Sources used:
SUSE Enterprise Storage 6 (src):    grafana-8.5.13-150100.3.12.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.

Comment 10 Swamp Workflow Management 2022-12-13 11:27:28 UTC

SUSE-SU-2022:4428-1: An update that fixes 12 vulnerabilities, contains one feature is now available.

Category: security (important)
Bug References: 1188571,1189520,1192383,1192763,1193492,1193686,1199810,1201535,1201539,1203596,1203597
CVE References: CVE-2021-36222,CVE-2021-3711,CVE-2021-41174,CVE-2021-41244,CVE-2021-43798,CVE-2021-43813,CVE-2021-43815,CVE-2022-29170,CVE-2022-31097,CVE-2022-31107,CVE-2022-35957,CVE-2022-36062
JIRA References: PED-2145
Sources used:
openSUSE Leap 15.4 (src):    grafana-8.5.13-150200.3.29.5
openSUSE Leap 15.3 (src):    grafana-8.5.13-150200.3.29.5
SUSE Linux Enterprise Module for Packagehub Subpackages 15-SP4 (src):    grafana-8.5.13-150200.3.29.5

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.

Comment 11 Swamp Workflow Management 2022-12-13 11:30:58 UTC

SUSE-SU-2022:4437-1: An update that solves 12 vulnerabilities, contains one feature and has two fixes is now available.

Category: security (important)
Bug References: 1188571,1189520,1192383,1192763,1193492,1193686,1199810,1201535,1201539,1202945,1203283,1203596,1203597,1203599
CVE References: CVE-2021-36222,CVE-2021-3711,CVE-2021-41174,CVE-2021-41244,CVE-2021-43798,CVE-2021-43813,CVE-2021-43815,CVE-2022-29170,CVE-2022-31097,CVE-2022-31107,CVE-2022-35957,CVE-2022-36062
JIRA References: PED-2145
Sources used:
openSUSE Leap 15.4 (src):    dracut-saltboot-0.1.1665997480.587fa10-150000.1.41.1, golang-github-boynux-squid_exporter-1.6-150000.1.9.1, golang-github-prometheus-promu-0.13.0-150000.3.9.1, prometheus-blackbox_exporter-0.19.0-150000.1.14.3, spacecmd-4.3.16-150000.3.89.1, wire-0.5.0-150000.1.9.3
openSUSE Leap 15.3 (src):    dracut-saltboot-0.1.1665997480.587fa10-150000.1.41.1, golang-github-boynux-squid_exporter-1.6-150000.1.9.1, golang-github-prometheus-promu-0.13.0-150000.3.9.1, spacecmd-4.3.16-150000.3.89.1
SUSE Manager Tools for SLE Micro 5 (src):    dracut-saltboot-0.1.1665997480.587fa10-150000.1.41.1, prometheus-blackbox_exporter-0.19.0-150000.1.14.3, uyuni-proxy-systemd-services-4.3.7-150000.1.9.3
SUSE Manager Tools 15 (src):    dracut-saltboot-0.1.1665997480.587fa10-150000.1.41.1, golang-github-boynux-squid_exporter-1.6-150000.1.9.1, grafana-8.5.13-150000.1.36.3, prometheus-blackbox_exporter-0.19.0-150000.1.14.3, spacecmd-4.3.16-150000.3.89.1, spacewalk-client-tools-4.3.13-150000.3.71.3, uyuni-proxy-systemd-services-4.3.7-150000.1.9.3
SUSE Linux Enterprise Module for SUSE Manager Proxy 4.3 (src):    golang-github-boynux-squid_exporter-1.6-150000.1.9.1, prometheus-blackbox_exporter-0.19.0-150000.1.14.3
SUSE Linux Enterprise Module for SUSE Manager Proxy 4.2 (src):    golang-github-boynux-squid_exporter-1.6-150000.1.9.1, prometheus-blackbox_exporter-0.19.0-150000.1.14.3

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.

Comment 12 Swamp Workflow Management 2022-12-13 11:47:10 UTC

SUSE-SU-2022:4439-1: An update that solves 12 vulnerabilities, contains one feature and has two fixes is now available.

Category: security (moderate)
Bug References: 1188571,1189520,1192383,1192763,1193492,1193686,1199810,1201535,1201539,1202945,1203283,1203596,1203597,1203599
CVE References: CVE-2021-36222,CVE-2021-3711,CVE-2021-41174,CVE-2021-41244,CVE-2021-43798,CVE-2021-43813,CVE-2021-43815,CVE-2022-29170,CVE-2022-31097,CVE-2022-31107,CVE-2022-35957,CVE-2022-36062
JIRA References: PED-2145
Sources used:
SUSE Manager Tools 12 (src):    golang-github-boynux-squid_exporter-1.6-1.9.1, grafana-8.5.13-1.36.2, prometheus-blackbox_exporter-0.19.0-1.14.1, spacecmd-4.3.16-38.112.1, spacewalk-client-tools-4.3.13-52.80.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.

Comment 14 Maintenance Automation 2024-01-23 20:30:10 UTC

SUSE-SU-2024:0196-1: An update that solves 44 vulnerabilities, contains 14 features and has 35 security fixes can now be installed.

Category: security (moderate)
Bug References: 1172110, 1176460, 1180816, 1180942, 1181119, 1181935, 1183684, 1187725, 1188061, 1188571, 1189520, 1191454, 1192154, 1192383, 1192696, 1192763, 1193492, 1193686, 1193688, 1197507, 1198903, 1199810, 1200142, 1200480, 1200591, 1200968, 1200970, 1201003, 1201059, 1201535, 1201539, 1202614, 1202945, 1203283, 1203596, 1203597, 1203599, 1204032, 1204126, 1204302, 1204303, 1204304, 1204305, 1204501, 1205207, 1205225, 1205227, 1205599, 1205759, 1207352, 1207749, 1207750, 1207830, 1208046, 1208049, 1208060, 1208062, 1208065, 1208270, 1208293, 1208298, 1208612, 1208692, 1208719, 1208819, 1208821, 1208965, 1209113, 1209645, 1210458, 1210640, 1210907, 1211525, 1212099, 1212100, 1212279, 1212641, 1218843, 1218844
CVE References: CVE-2020-7753, CVE-2021-20178, CVE-2021-20180, CVE-2021-20191, CVE-2021-20228, CVE-2021-3447, CVE-2021-3583, CVE-2021-3620, CVE-2021-36222, CVE-2021-3711, CVE-2021-3807, CVE-2021-3918, CVE-2021-41174, CVE-2021-41244, CVE-2021-43138, CVE-2021-43798, CVE-2021-43813, CVE-2021-43815, CVE-2022-0155, CVE-2022-23552, CVE-2022-27664, CVE-2022-29170, CVE-2022-31097, CVE-2022-31107, CVE-2022-31123, CVE-2022-31130, CVE-2022-32149, CVE-2022-35957, CVE-2022-36062, CVE-2022-39201, CVE-2022-39229, CVE-2022-39306, CVE-2022-39307, CVE-2022-39324, CVE-2022-41715, CVE-2022-41723, CVE-2022-46146, CVE-2023-0507, CVE-2023-0594, CVE-2023-1387, CVE-2023-1410, CVE-2023-2183, CVE-2023-2801, CVE-2023-3128
Jira References: MSQA-718, PED-2145, PED-2617, PED-3576, PED-3694, PED-4556, PED-5405, PED-5406, SLE-23422, SLE-23439, SLE-23631, SLE-24133, SLE-24565, SLE-24791
Sources used:
SUSE Manager Client Tools Beta for SLE Micro 5 (src): golang-github-QubitProducts-exporter_exporter-0.4.0-159000.4.6.1, prometheus-blackbox_exporter-0.24.0-159000.3.6.1, uyuni-proxy-systemd-services-5.0.1-159000.3.9.1, dracut-saltboot-0.1.1681904360.84ef141-159000.3.30.1
SUSE Manager Client Tools Beta for SLE 15 (src): python-pyvmomi-6.7.3-159000.3.6.1, golang-github-QubitProducts-exporter_exporter-0.4.0-159000.4.6.1, supportutils-plugin-salt-1.2.2-159000.5.9.1, uyuni-proxy-systemd-services-5.0.1-159000.3.9.1, mgr-push-5.0.1-159000.4.21.1, golang-github-lusitaniae-apache_exporter-1.0.0-159000.4.12.1, rhnlib-5.0.1-159000.6.30.1, golang-github-prometheus-prometheus-2.45.0-159000.6.33.1, spacewalk-client-tools-5.0.1-159000.6.48.1, uyuni-common-libs-5.0.1-159000.3.33.1, dracut-saltboot-0.1.1681904360.84ef141-159000.3.30.1, golang-github-boynux-squid_exporter-1.6-159000.4.9.1, ansible-2.9.27-159000.3.9.1, prometheus-postgres_exporter-0.10.1-159000.3.6.1, grafana-9.5.8-159000.4.24.1, spacecmd-5.0.1-159000.6.42.1, python-hwdata-2.3.5-159000.5.13.1, prometheus-blackbox_exporter-0.24.0-159000.3.6.1, supportutils-plugin-susemanager-client-5.0.1-159000.6.15.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.

Comment 15 Maintenance Automation 2024-01-23 20:30:42 UTC

SUSE-SU-2024:0191-1: An update that solves 45 vulnerabilities, contains 17 features and has 30 security fixes can now be installed.

Category: security (moderate)
Bug References: 1047218, 1172110, 1188571, 1189520, 1191454, 1192154, 1192383, 1192696, 1192763, 1193492, 1193686, 1193688, 1194873, 1195726, 1195727, 1195728, 1196338, 1196652, 1197507, 1198903, 1199810, 1200480, 1200591, 1200725, 1201003, 1201059, 1201535, 1201539, 1203283, 1203596, 1203597, 1203599, 1204032, 1204089, 1204126, 1204302, 1204303, 1204304, 1204305, 1204501, 1205207, 1205225, 1205227, 1205759, 1207352, 1207749, 1207750, 1207830, 1208046, 1208049, 1208051, 1208060, 1208062, 1208064, 1208065, 1208270, 1208293, 1208298, 1208612, 1208692, 1208719, 1208819, 1208821, 1208965, 1209113, 1209645, 1210458, 1210907, 1211525, 1212099, 1212100, 1212279, 1212641, 1218843, 1218844
CVE References: CVE-2020-7753, CVE-2021-36222, CVE-2021-3711, CVE-2021-3807, CVE-2021-3918, CVE-2021-39226, CVE-2021-41174, CVE-2021-41244, CVE-2021-43138, CVE-2021-43798, CVE-2021-43813, CVE-2021-43815, CVE-2022-0155, CVE-2022-21673, CVE-2022-21698, CVE-2022-21702, CVE-2022-21703, CVE-2022-21713, CVE-2022-23552, CVE-2022-27191, CVE-2022-27664, CVE-2022-29170, CVE-2022-31097, CVE-2022-31107, CVE-2022-31123, CVE-2022-31130, CVE-2022-32149, CVE-2022-35957, CVE-2022-36062, CVE-2022-39201, CVE-2022-39229, CVE-2022-39306, CVE-2022-39307, CVE-2022-39324, CVE-2022-41715, CVE-2022-41723, CVE-2022-46146, CVE-2023-0507, CVE-2023-0594, CVE-2023-1387, CVE-2023-1410, CVE-2023-2183, CVE-2023-2801, CVE-2023-3128, CVE-2023-40577
Jira References: MSQA-718, PED-2145, PED-2617, PED-3576, PED-3578, PED-3694, PED-4556, PED-5405, PED-5406, PED-7353, SLE-23422, SLE-23439, SLE-24238, SLE-24239, SLE-24565, SLE-24791, SUMA-114
Sources used:
SUSE Manager Client Tools Beta for SLE 12 (src): rhnlib-5.0.1-24.30.3, spacecmd-5.0.1-41.42.3, grafana-9.5.8-4.21.2, prometheus-postgres_exporter-0.10.1-3.6.4, golang-github-prometheus-node_exporter-1.5.0-4.15.4, golang-github-QubitProducts-exporter_exporter-0.4.0-4.6.2, system-user-grafana-1.0.0-3.7.2, kiwi-desc-saltboot-0.1.1687520761.cefb248-4.15.2, golang-github-prometheus-prometheus-2.45.0-4.33.3, supportutils-plugin-susemanager-client-5.0.1-9.15.2, uyuni-common-libs-5.0.1-3.33.3, prometheus-blackbox_exporter-0.24.0-3.6.3, golang-github-lusitaniae-apache_exporter-1.0.0-4.12.4, golang-github-prometheus-alertmanager-0.26.0-4.12.4, system-user-prometheus-1.0.0-3.7.2, python-hwdata-2.3.5-15.12.2, golang-github-boynux-squid_exporter-1.6-4.9.2, supportutils-plugin-salt-1.2.2-9.9.2, golang-github-prometheus-promu-0.14.0-4.12.2, mgr-push-5.0.1-4.21.4

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.

Comment 18 Maintenance Automation 2024-02-15 16:32:02 UTC

SUSE-SU-2024:0487-1: An update that solves eight vulnerabilities and contains one feature can now be installed.

Category: security (moderate)
Bug References: 1192154, 1192696, 1193492, 1193686, 1200480, 1204023, 1218843, 1218844
CVE References: CVE-2020-7753, CVE-2021-3807, CVE-2021-3918, CVE-2021-43138, CVE-2021-43798, CVE-2021-43815, CVE-2022-0155, CVE-2022-41715
Jira References: MSQA-719
Sources used:
openSUSE Leap 15.5 (src): golang-github-lusitaniae-apache_exporter-1.0.0-150000.1.20.1, spacecmd-4.3.26-150000.3.113.1, prometheus-postgres_exporter-0.10.1-150000.1.17.1
SUSE Manager Client Tools for SLE 15 (src): spacewalk-client-tools-4.3.18-150000.3.86.2, mgr-daemon-4.3.8-150000.1.44.1, uyuni-proxy-systemd-services-4.3.10-150000.1.15.1, spacecmd-4.3.26-150000.3.113.1, golang-github-lusitaniae-apache_exporter-1.0.0-150000.1.20.1, golang-github-prometheus-prometheus-2.45.0-150000.3.53.1, grafana-9.5.8-150000.1.60.2, prometheus-postgres_exporter-0.10.1-150000.1.17.1
SUSE Manager Client Tools for SLE Micro 5 (src): uyuni-proxy-systemd-services-4.3.10-150000.1.15.1
SUSE Manager Proxy 4.3 Module 4.3 (src): golang-github-lusitaniae-apache_exporter-1.0.0-150000.1.20.1
SUSE Manager Server 4.3 Module 4.3 (src): golang-github-lusitaniae-apache_exporter-1.0.0-150000.1.20.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.

Comment 19 Maintenance Automation 2024-02-15 16:32:07 UTC

SUSE-SU-2024:0486-1: An update that solves nine vulnerabilities and contains two features can now be installed.

Category: security (moderate)
Bug References: 1192154, 1192696, 1193492, 1193686, 1200480, 1204023, 1218838, 1218843, 1218844
CVE References: CVE-2020-7753, CVE-2021-3807, CVE-2021-3918, CVE-2021-43138, CVE-2021-43798, CVE-2021-43815, CVE-2022-0155, CVE-2022-41715, CVE-2023-40577
Jira References: MSQA-719, PED-7353
Sources used:
SUSE Manager Client Tools for SLE 12 (src): spacewalk-client-tools-4.3.18-52.95.2, mgr-daemon-4.3.8-1.44.2, golang-github-prometheus-alertmanager-0.26.0-1.24.2, golang-github-lusitaniae-apache_exporter-1.0.0-1.21.2, grafana-9.5.8-1.60.1, spacecmd-4.3.26-38.136.2, golang-github-prometheus-prometheus-2.45.0-1.50.2, prometheus-postgres_exporter-0.10.1-1.17.2

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.

Comment 20 Maintenance Automation 2024-03-04 12:30:09 UTC

SUSE-RU-2024:0746-1: An update that contains two features and has nine fixes can now be installed.

Category: recommended (moderate)
Bug References: 1192154, 1192696, 1193492, 1193686, 1200480, 1204023, 1218838, 1218843, 1218844
Jira References: MSQA-720, PED-7843
Sources used:
SUSE Manager Client Tools Beta for SLE 12 (src): golang-github-prometheus-prometheus-2.45.0-4.36.1, spacewalk-client-tools-5.0.3-55.48.1, supportutils-plugin-susemanager-client-5.0.2-9.18.1, rhnlib-5.0.2-24.33.1, uyuni-tools-0.1.4-3.3.1, golang-github-prometheus-alertmanager-0.26.0-4.15.1, uyuni-common-libs-5.0.2-3.36.1, grafana-9.5.8-4.24.1, spacecmd-5.0.4-41.45.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.

Comment 21 Maintenance Automation 2024-03-04 12:30:14 UTC

SUSE-RU-2024:0745-1: An update that contains two features and has eight fixes can now be installed.

Category: recommended (moderate)
Bug References: 1192154, 1192696, 1193492, 1193686, 1200480, 1204023, 1218843, 1218844
Jira References: MSQA-720, PED-7843
Sources used:
SUSE Manager Client Tools Beta for SLE 15 (src): supportutils-plugin-susemanager-client-5.0.2-159000.6.18.1, grafana-9.5.8-159000.4.27.1, uyuni-tools-0.1.4-159000.3.3.1, uyuni-common-libs-5.0.2-159000.3.36.1, golang-github-prometheus-prometheus-2.45.0-159000.6.36.1, spacecmd-5.0.4-159000.6.45.1, spacewalk-client-tools-5.0.3-159000.6.51.1, rhnlib-5.0.2-159000.6.33.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.