Improper Verification of Cryptographic Signature Affecting grafana-prometheus package, versions *
Threat Intelligence
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-CENTOS8-GRAFANAPROMETHEUS-3045851
- published 14 Oct 2022
- disclosed 14 Oct 2022
Introduced: 14 Oct 2022
CVE-2022-31123 Open this link in a new tabHow to fix?
There is no fixed version for Centos:8 grafana-prometheus.
NVD Description
Note: Versions mentioned in the description apply only to the upstream grafana-prometheus package and not the grafana-prometheus package as distributed by Centos.
See How to fix? for Centos:8 relevant fixed versions and status.
Grafana is an open source observability and data visualization platform. Versions prior to 9.1.8 and 8.5.14 are vulnerable to a bypass in the plugin signature verification. An attacker can convince a server admin to download and successfully run a malicious plugin even though unsigned plugins are not allowed. Versions 9.1.8 and 8.5.14 contain a patch for this issue. As a workaround, do not install plugins downloaded from untrusted sources.