Input validation error in Grafana - CVE-2022-29170

Vulnerability identifier: #VU63461

CSH Severity: Low

CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2022-29170

CWE-ID: CWE-20

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform spoofing attack.

The vulnerability exists due to insufficient validation of user-supplied input when processing HTTP Host header during redirection. A remote attacker can perform spoofing attack.

Grafana
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise Desktop 12
SUSE Linux Enterprise Server 12
SUSE Linux Enterprise Desktop 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Server for SAP Applications 12
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise High Performance Computing 12
SUSE Manager Client Tools Beta for SLE Micro
SUSE Linux Enterprise Micro
SUSE Manager Client Tools Beta for SLE
SUSE Linux Enterprise Server for the Raspberry Pi
SUSE Linux Enterprise Server
SUSE Linux Enterprise Server for SAP Applications
SUSE Linux Enterprise Desktop
SUSE Linux Enterprise High Performance Computing
openSUSE Leap
openEuler
ObjectScale
IBM Watson Machine Learning Accelerator
firewalld-prometheus-config
dracut-saltboot
kiwi-desc-saltboot
golang-github-QubitProducts-exporter_exporter
prometheus-postgres_exporter
golang-github-prometheus-promu
prometheus-blackbox_exporter-debuginfo
prometheus-blackbox_exporter
golang-github-prometheus-alertmanager
system-user-grafana
system-user-prometheus
golang-github-lusitaniae-apache_exporter
golang-github-lusitaniae-apache_exporter-debuginfo
supportutils-plugin-salt
golang-github-prometheus-node_exporter
golang-github-boynux-squid_exporter
golang-github-boynux-squid_exporter-debuginfo
python2-hwdata
python3-hwdata
ansible-doc
ansible
golang-github-prometheus-prometheus
python2-uyuni-common-libs
python2-mgr-push
mgr-push
supportutils-plugin-susemanager-client
python2-rhnlib
spacecmd
uyuni-proxy-systemd-services
python3-uyuni-common-libs
python3-mgr-push
python3-rhnlib
spacewalk-client-tools
python3-spacewalk-client-tools
spacewalk-check
python3-spacewalk-client-setup
python3-spacewalk-check
spacewalk-client-setup
python3-pyvmomi
grafana
grafana-debuginfo

Install updates from vendor's website.

Grafana - addressed in versions 7.5.16, 8.5.3
ObjectScale - update to 1.3.0
IBM Watson Machine Learning Accelerator - update to 3.0.0
firewalld-prometheus-config - update to 0.1-159000.6.33.1
dracut-saltboot - update to 0.1.1681904360.84ef141-159000.3.30.1
kiwi-desc-saltboot - update to 0.1.1687520761.cefb248-4.15.2
golang-github-QubitProducts-exporter_exporter - addressed in versions 0.4.0-4.6.2, 0.4.0-159000.4.6.1
prometheus-postgres_exporter - addressed in versions 0.10.1-3.6.4, 0.10.1-159000.3.6.1
golang-github-prometheus-promu - update to 0.14.0-4.12.2
prometheus-blackbox_exporter-debuginfo - update to 0.24.0-3.6.3
prometheus-blackbox_exporter - addressed in versions 0.24.0-3.6.3, 0.24.0-159000.3.6.1
golang-github-prometheus-alertmanager - update to 0.26.0-4.12.4
system-user-grafana - update to 1.0.0-3.7.2
system-user-prometheus - update to 1.0.0-3.7.2
golang-github-lusitaniae-apache_exporter - addressed in versions 1.0.0-4.12.4, 1.0.0-159000.4.12.1
golang-github-lusitaniae-apache_exporter-debuginfo - update to 1.0.0-159000.4.12.1
supportutils-plugin-salt - addressed in versions 1.2.2-9.9.2, 1.2.2-159000.5.9.1
golang-github-prometheus-node_exporter - update to 1.5.0-4.15.4
golang-github-boynux-squid_exporter - addressed in versions 1.6-4.9.2, 1.6-159000.4.9.1
golang-github-boynux-squid_exporter-debuginfo - update to 1.6-159000.4.9.1
python2-hwdata - update to 2.3.5-15.12.2
python3-hwdata - update to 2.3.5-159000.5.13.1
ansible-doc - update to 2.9.27-159000.3.9.1
ansible - update to 2.9.27-159000.3.9.1
golang-github-prometheus-prometheus - addressed in versions 2.45.0-4.33.3, 2.45.0-159000.6.33.1
python2-uyuni-common-libs - update to 5.0.1-3.33.3
python2-mgr-push - update to 5.0.1-4.21.4
mgr-push - addressed in versions 5.0.1-4.21.4, 5.0.1-159000.4.21.1
supportutils-plugin-susemanager-client - addressed in versions 5.0.1-9.15.2, 5.0.1-159000.6.15.1
python2-rhnlib - update to 5.0.1-24.30.3
spacecmd - addressed in versions 5.0.1-41.42.3, 5.0.1-159000.6.42.1
uyuni-proxy-systemd-services - update to 5.0.1-159000.3.9.1
python3-uyuni-common-libs - update to 5.0.1-159000.3.33.1
python3-mgr-push - update to 5.0.1-159000.4.21.1
python3-rhnlib - update to 5.0.1-159000.6.30.1
spacewalk-client-tools - update to 5.0.1-159000.6.48.1
python3-spacewalk-client-tools - update to 5.0.1-159000.6.48.1
spacewalk-check - update to 5.0.1-159000.6.48.1
python3-spacewalk-client-setup - update to 5.0.1-159000.6.48.1
python3-spacewalk-check - update to 5.0.1-159000.6.48.1
spacewalk-client-setup - update to 5.0.1-159000.6.48.1
python3-pyvmomi - update to 6.7.3-159000.3.6.1
grafana - update to 7.5.15-2
grafana-debuginfo - update to 7.5.15-2
grafana - addressed in versions 9.5.8-4.21.2, 9.5.8-159000.4.24.1
grafana-debuginfo - update to 9.5.8-159000.4.24.1

• https://github.com/grafana/grafana/releases/tag/v7.5.16
• https://github.com/grafana/grafana/releases/tag/v8.5.3
• https://github.com/grafana/grafana/pull/49254

• Spoofing attack in Grafana
• SUSE update for Security Beta update for SUSE Manager Client Tools and Salt
• SUSE update for Security Beta update for SUSE Manager Client Tools
• Multiple vulnerabilities in IBM Watson Machine Learning Accelerator on Cloud Pak for Data
• openEuler update for grafana
• Multiple vulnerabilities in Dell ObjectScale