RHSA-2024:6947

Security

Issued at: 2024-09-23

Synopsis

Important: grafana security update

Description

Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB & OpenTSDB.

Security Fix(es):

* encoding/gob: golang: Calling Decoder.Decode on a message which contains deeply nested structures can cause a panic due to stack exhaustion (CVE-2024-34156)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Affected products

Red Hat Enterprise Linux for ARM 64 - 9 Red Hat Enterprise Linux for IBM z Systems - 9 Red Hat Enterprise Linux for Power, little endian - 9 Red Hat Enterprise Linux for x86_64 - 9

Fixes

2310528

CVEs

CVE-2024-34156

Affected packages

grafana-0:9.2.10-17.el9_4.aarch64 grafana-0:9.2.10-17.el9_4.ppc64le grafana-0:9.2.10-17.el9_4.s390x grafana-0:9.2.10-17.el9_4.src grafana-0:9.2.10-17.el9_4.x86_64 grafana-debuginfo-0:9.2.10-17.el9_4.aarch64 grafana-debuginfo-0:9.2.10-17.el9_4.ppc64le grafana-debuginfo-0:9.2.10-17.el9_4.s390x grafana-debuginfo-0:9.2.10-17.el9_4.x86_64 grafana-debugsource-0:9.2.10-17.el9_4.aarch64 grafana-debugsource-0:9.2.10-17.el9_4.ppc64le grafana-debugsource-0:9.2.10-17.el9_4.s390x grafana-debugsource-0:9.2.10-17.el9_4.x86_64 grafana-selinux-0:9.2.10-17.el9_4.aarch64 grafana-selinux-0:9.2.10-17.el9_4.ppc64le grafana-selinux-0:9.2.10-17.el9_4.s390x grafana-selinux-0:9.2.10-17.el9_4.x86_64