Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

x/vulndb: potential Go vuln in github.com/grafana/grafana: GHSA-x744-mm8v-vpgr #2858

Closed
GoVulnBot opened this issue May 15, 2024 · 2 comments
Closed

x/vulndb: potential Go vuln in github.com/grafana/grafana: GHSA-x744-mm8v-vpgr #2858

GoVulnBot opened this issue May 15, 2024 · 2 comments
Labels
triaged

Comments

@GoVulnBot
Copy link

In GitHub Security Advisory GHSA-x744-mm8v-vpgr, there is a vulnerability in the following Go packages or modules:

Unit Fixed Vulnerable Ranges
github.com/grafana/grafana 9.1.8 >= 9.0.0, < 9.1.8

Cross references:

See doc/triage.md for instructions on how to triage this report.

id: GO-ID-PENDING
modules:
    - module: github.com/grafana/grafana
      versions:
        - introduced: 5.0.0-beta1+incompatible
          fixed: 8.5.14
        - introduced: 9.0.0
          fixed: 9.1.8
      packages:
        - package: github.com/grafana/grafana
summary: |-
    Grafana Data source and plugin proxy endpoints could leak the authentication
    cookie to some destination plugins in github.com/grafana/grafana
cves:
    - CVE-2022-39201
ghsas:
    - GHSA-x744-mm8v-vpgr
references:
    - advisory: https://github.com/grafana/grafana/security/advisories/GHSA-x744-mm8v-vpgr
    - fix: https://github.com/grafana/grafana/commit/b571acc1dc130a33f24742c1f93b93216da6cf57
    - fix: https://github.com/grafana/grafana/commit/c658816f5229d17f877579250c07799d3bbaebc9
    - web: https://github.com/grafana/grafana/releases/tag/v9.1.8
source:
    id: GHSA-x744-mm8v-vpgr
@gopherbot
Copy link
Contributor

Change https://go.dev/cl/591202 mentions this issue: data/reports: add 9 unreviewed reports

@gopherbot
Copy link
Contributor

Change https://go.dev/cl/606359 mentions this issue: data/reports: regenerate 50 reports

gopherbot pushed a commit that referenced this issue Aug 19, 2024
@tatianab @gopherbot
data/reports: regenerate 50 reports
4c06ac4 
  - data/reports/GO-2024-2642.yaml
  - data/reports/GO-2024-2644.yaml
  - data/reports/GO-2024-2645.yaml
  - data/reports/GO-2024-2664.yaml
  - data/reports/GO-2024-2665.yaml
  - data/reports/GO-2024-2675.yaml
  - data/reports/GO-2024-2684.yaml
  - data/reports/GO-2024-2690.yaml
  - data/reports/GO-2024-2697.yaml
  - data/reports/GO-2024-2704.yaml
  - data/reports/GO-2024-2707.yaml
  - data/reports/GO-2024-2718.yaml
  - data/reports/GO-2024-2719.yaml
  - data/reports/GO-2024-2728.yaml
  - data/reports/GO-2024-2741.yaml
  - data/reports/GO-2024-2752.yaml
  - data/reports/GO-2024-2757.yaml
  - data/reports/GO-2024-2769.yaml
  - data/reports/GO-2024-2792.yaml
  - data/reports/GO-2024-2801.yaml
  - data/reports/GO-2024-2815.yaml
  - data/reports/GO-2024-2843.yaml
  - data/reports/GO-2024-2844.yaml
  - data/reports/GO-2024-2847.yaml
  - data/reports/GO-2024-2848.yaml
  - data/reports/GO-2024-2851.yaml
  - data/reports/GO-2024-2852.yaml
  - data/reports/GO-2024-2854.yaml
  - data/reports/GO-2024-2855.yaml
  - data/reports/GO-2024-2856.yaml
  - data/reports/GO-2024-2857.yaml
  - data/reports/GO-2024-2858.yaml
  - data/reports/GO-2024-2866.yaml
  - data/reports/GO-2024-2867.yaml
  - data/reports/GO-2024-2877.yaml
  - data/reports/GO-2024-2886.yaml
  - data/reports/GO-2024-2891.yaml
  - data/reports/GO-2024-2898.yaml
  - data/reports/GO-2024-2901.yaml
  - data/reports/GO-2024-2902.yaml
  - data/reports/GO-2024-2905.yaml
  - data/reports/GO-2024-2911.yaml
  - data/reports/GO-2024-2917.yaml
  - data/reports/GO-2024-2919.yaml
  - data/reports/GO-2024-2922.yaml
  - data/reports/GO-2024-2939.yaml
  - data/reports/GO-2024-2941.yaml
  - data/reports/GO-2024-2972.yaml
  - data/reports/GO-2024-2981.yaml
  - data/reports/GO-2024-2987.yaml

Updates #2642
Updates #2644
Updates #2645
Updates #2664
Updates #2665
Updates #2675
Updates #2684
Updates #2690
Updates #2697
Updates #2704
Updates #2707
Updates #2718
Updates #2719
Updates #2728
Updates #2741
Updates #2752
Updates #2757
Updates #2769
Updates #2792
Updates #2801
Updates #2815
Updates #2843
Updates #2844
Updates #2847
Updates #2848
Updates #2851
Updates #2852
Updates #2854
Updates #2855
Updates #2856
Updates #2857
Updates #2858
Updates #2866
Updates #2867
Updates #2877
Updates #2886
Updates #2891
Updates #2898
Updates #2901
Updates #2902
Updates #2905
Updates #2911
Updates #2917
Updates #2919
Updates #2922
Updates #2939
Updates #2941
Updates #2972
Updates #2981
Updates #2987

Change-Id: I2dff127628eabc7c25afa4020c15a4d35a46a2c4
Reviewed-on: https://go-review.googlesource.com/c/vulndb/+/606359
LUCI-TryBot-Result: Go LUCI <[email protected]>
Auto-Submit: Tatiana Bradley <[email protected]>
Reviewed-by: Damien Neil <[email protected]>
@GoVulnBot GoVulnBot mentioned this issue Aug 20, 2024
Closed
This was referenced Oct 25, 2024
Closed
Closed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
triaged
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
3 participants
@tatianab @gopherbot @GoVulnBot