Improper Verification of Cryptographic Signature Affecting grafana package, versions <0:9.2.10-7.el9_3


Severity

Recommended
0.0
medium
0
10

Based on CentOS security rating.

Threat Intelligence

Exploit Maturity
Not Defined
EPSS
0.08% (36th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-CENTOS9-GRAFANA-3043999
  • published14 Oct 2022
  • disclosed14 Oct 2022

Introduced: 14 Oct 2022

CVE-2022-31123  (opens in a new tab)
CWE-347  (opens in a new tab)

How to fix?

Upgrade Centos:9 grafana to version 0:9.2.10-7.el9_3 or higher.

NVD Description

Note: Versions mentioned in the description apply only to the upstream grafana package and not the grafana package as distributed by Centos. See How to fix? for Centos:9 relevant fixed versions and status.

Grafana is an open source observability and data visualization platform. Versions prior to 9.1.8 and 8.5.14 are vulnerable to a bypass in the plugin signature verification. An attacker can convince a server admin to download and successfully run a malicious plugin even though unsigned plugins are not allowed. Versions 9.1.8 and 8.5.14 contain a patch for this issue. As a workaround, do not install plugins downloaded from untrusted sources.

CVSS Scores

version 3.1