Improper Verification of Cryptographic Signature Affecting grafana package, versions <0:9.2.10-7.el9_3.alma.1
Threat Intelligence
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-ALMALINUX9-GRAFANA-6062089
- published 15 Nov 2023
- disclosed 7 Nov 2023
Introduced: 7 Nov 2023
CVE-2022-31123 Open this link in a new tabHow to fix?
Upgrade AlmaLinux:9 grafana to version 0:9.2.10-7.el9_3.alma.1 or higher.
This issue was patched in ALSA-2023:6420.
NVD Description
Note: Versions mentioned in the description apply only to the upstream grafana package and not the grafana package as distributed by AlmaLinux.
See How to fix? for AlmaLinux:9 relevant fixed versions and status.
Grafana is an open source observability and data visualization platform. Versions prior to 9.1.8 and 8.5.14 are vulnerable to a bypass in the plugin signature verification. An attacker can convince a server admin to download and successfully run a malicious plugin even though unsigned plugins are not allowed. Versions 9.1.8 and 8.5.14 contain a patch for this issue. As a workaround, do not install plugins downloaded from untrusted sources.
References
- https://errata.almalinux.org/9/ALSA-2023-6420.html
- https://access.redhat.com/security/cve/CVE-2022-31123
- https://access.redhat.com/errata/RHSA-2023:6420
- https://github.com/grafana/grafana/releases/tag/v9.1.8
- https://github.com/grafana/grafana/security/advisories/GHSA-rhxj-gh46-jvw8
- https://security.netapp.com/advisory/ntap-20221124-0002/