Improper Verification of Cryptographic Signature Affecting grafana package, versions <0:9.2.10-7.el9_3
Threat Intelligence
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-CENTOS9-GRAFANA-3043999
- published 14 Oct 2022
- disclosed 14 Oct 2022
Introduced: 14 Oct 2022
CVE-2022-31123 Open this link in a new tabHow to fix?
Upgrade Centos:9 grafana to version 0:9.2.10-7.el9_3 or higher.
NVD Description
Note: Versions mentioned in the description apply only to the upstream grafana package and not the grafana package as distributed by Centos.
See How to fix? for Centos:9 relevant fixed versions and status.
Grafana is an open source observability and data visualization platform. Versions prior to 9.1.8 and 8.5.14 are vulnerable to a bypass in the plugin signature verification. An attacker can convince a server admin to download and successfully run a malicious plugin even though unsigned plugins are not allowed. Versions 9.1.8 and 8.5.14 contain a patch for this issue. As a workaround, do not install plugins downloaded from untrusted sources.