Docker grafana/grafana:6.7.3-ubuntu

Vulnerabilities

50 via 86 paths

Dependencies

129

Source

Group 6 Copy Created with Sketch. Docker

Target OS

ubuntu:19.10
Test your Docker Hub image against our market leading vulnerability database Sign up for free
Severity
  • 1
  • 14
  • 35
Status
  • 50
  • 0
  • 0

high severity

Use of a Broken or Risky Cryptographic Algorithm

  • Vulnerable module: gnutls28/libgnutls30
  • Introduced through: gnutls28/libgnutls30@3.6.9-5ubuntu1.1
  • Fixed in: 3.6.9-5ubuntu1.2

Detailed paths

  • Introduced through: grafana/grafana:6.7.3-ubuntu@* gnutls28/libgnutls30@3.6.9-5ubuntu1.1

Overview

Affected versions of this package are vulnerable to Use of a Broken or Risky Cryptographic Algorithm. GnuTLS 3.6.x before 3.6.14 uses incorrect cryptography for encrypting a session ticket (a loss of confidentiality in TLS 1.2, and an authentication bypass in TLS 1.3). The earliest affected version is 3.6.4 (2018-09-24) because of an error in a 2018-09-18 commit. Until the first key rotation, the TLS server always uses wrong data in place of an encryption key derived from an application.

Remediation

Upgrade gnutls28 to version or higher.

References

medium severity

Improper Input Validation

  • Vulnerable module: apt
  • Introduced through: apt@1.9.4 and apt/libapt-pkg5.90@1.9.4
  • Fixed in: 1.9.4ubuntu0.1

Detailed paths

  • Introduced through: grafana/grafana:6.7.3-ubuntu@* apt@1.9.4
  • Introduced through: grafana/grafana:6.7.3-ubuntu@* apt/libapt-pkg5.90@1.9.4

Overview

Affected versions of this package are vulnerable to Improper Input Validation. Missing input validation in the ar/tar implementations of APT before version 2.1.2 could result in denial of service when processing specially crafted deb files.

Remediation

Upgrade apt to version or higher.

References

medium severity

Arbitrary Code Injection

  • Vulnerable module: curl
  • Introduced through: curl@7.65.3-1ubuntu3 and curl/libcurl4@7.65.3-1ubuntu3
  • Fixed in: 7.65.3-1ubuntu3.1

Detailed paths

  • Introduced through: grafana/grafana:6.7.3-ubuntu@* curl@7.65.3-1ubuntu3
  • Introduced through: grafana/grafana:6.7.3-ubuntu@* curl/libcurl4@7.65.3-1ubuntu3

Overview

Affected versions of this package are vulnerable to Arbitrary Code Injection curl 7.20.0 through 7.70.0 is vulnerable to improper restriction of names for files and other resources that can lead too overwriting a local file when the -J flag is used.

Remediation

Upgrade curl to version or higher.

References

medium severity

Information Exposure

  • Vulnerable module: curl
  • Introduced through: curl@7.65.3-1ubuntu3 and curl/libcurl4@7.65.3-1ubuntu3
  • Fixed in: 7.65.3-1ubuntu3.1

Detailed paths

  • Introduced through: grafana/grafana:6.7.3-ubuntu@* curl@7.65.3-1ubuntu3
  • Introduced through: grafana/grafana:6.7.3-ubuntu@* curl/libcurl4@7.65.3-1ubuntu3

Overview

Affected versions of this package are vulnerable to Information Exposure curl 7.62.0 through 7.70.0 is vulnerable to an information disclosure vulnerability that can lead to a partial password being leaked over the network and to the DNS server(s).

Remediation

Upgrade curl to version or higher.

References

medium severity

Information Exposure

  • Vulnerable module: gcc-9/gcc-9-base
  • Introduced through: gcc-9/gcc-9-base@9.2.1-9ubuntu2, gcc-9/libgcc1@1:9.2.1-9ubuntu2 and others

Detailed paths

  • Introduced through: grafana/grafana:6.7.3-ubuntu@* gcc-9/gcc-9-base@9.2.1-9ubuntu2
  • Introduced through: grafana/grafana:6.7.3-ubuntu@* gcc-9/libgcc1@1:9.2.1-9ubuntu2
  • Introduced through: grafana/grafana:6.7.3-ubuntu@* gcc-9/libstdc++6@9.2.1-9ubuntu2

Overview

Affected versions of this package are vulnerable to Information Exposure. Arm Armv8-A core implementations utilizing speculative execution past unconditional changes in control flow may allow unauthorized disclosure of information to an attacker with local user access via a side-channel analysis, aka "straight-line speculation."

Remediation

There is no fixed version for gcc-9.

References

medium severity

Out-of-bounds Write

  • Vulnerable module: glibc/libc-bin
  • Introduced through: glibc/libc-bin@2.30-0ubuntu2.1 and glibc/libc6@2.30-0ubuntu2.1
  • Fixed in: 2.30-0ubuntu2.2

Detailed paths

  • Introduced through: grafana/grafana:6.7.3-ubuntu@* glibc/libc-bin@2.30-0ubuntu2.1
  • Introduced through: grafana/grafana:6.7.3-ubuntu@* glibc/libc6@2.30-0ubuntu2.1

Overview

Affected versions of this package are vulnerable to Out-of-bounds Write. An out-of-bounds write vulnerability was found in glibc before 2.31 when handling signal trampolines on PowerPC. Specifically, the backtrace function did not properly check the array bounds when storing the frame address, resulting in a denial of service or potential code execution. The highest threat from this vulnerability is to system availability.

Remediation

Upgrade glibc to version or higher.

References

medium severity

Reachable Assertion

  • Vulnerable module: krb5/krb5-locales
  • Introduced through: krb5/krb5-locales@1.17-6, krb5/libgssapi-krb5-2@1.17-6 and others

Detailed paths

  • Introduced through: grafana/grafana:6.7.3-ubuntu@* krb5/krb5-locales@1.17-6
  • Introduced through: grafana/grafana:6.7.3-ubuntu@* krb5/libgssapi-krb5-2@1.17-6
  • Introduced through: grafana/grafana:6.7.3-ubuntu@* krb5/libk5crypto3@1.17-6
  • Introduced through: grafana/grafana:6.7.3-ubuntu@* krb5/libkrb5-3@1.17-6
  • Introduced through: grafana/grafana:6.7.3-ubuntu@* krb5/libkrb5support0@1.17-6

Overview

Affected versions of this package are vulnerable to Reachable Assertion. A Reachable Assertion issue was discovered in the KDC in MIT Kerberos 5 (aka krb5) before 1.17. If an attacker can obtain a krbtgt ticket using an older encryption type (single-DES, triple-DES, or RC4), the attacker can crash the KDC by making an S4U2Self request.

Remediation

There is no fixed version for krb5.

References

medium severity

Resource Exhaustion

  • Vulnerable module: openldap/libldap-2.4-2
  • Introduced through: openldap/libldap-2.4-2@2.4.48+dfsg-1ubuntu1 and openldap/libldap-common@2.4.48+dfsg-1ubuntu1
  • Fixed in: 2.4.48+dfsg-1ubuntu1.1

Detailed paths

  • Introduced through: grafana/grafana:6.7.3-ubuntu@* openldap/libldap-2.4-2@2.4.48+dfsg-1ubuntu1
  • Introduced through: grafana/grafana:6.7.3-ubuntu@* openldap/libldap-common@2.4.48+dfsg-1ubuntu1

Overview

Affected versions of this package are vulnerable to Resource Exhaustion. In filter.c in slapd in OpenLDAP before 2.4.50, LDAP search filters with nested boolean expressions can result in denial of service (daemon crash).

Remediation

Upgrade openldap to version or higher.

References

medium severity

Integer Overflow or Wraparound

  • Vulnerable module: sqlite3/libsqlite3-0
  • Introduced through: sqlite3/libsqlite3-0@3.29.0-2ubuntu0.2
  • Fixed in: 3.29.0-2ubuntu0.3

Detailed paths

  • Introduced through: grafana/grafana:6.7.3-ubuntu@* sqlite3/libsqlite3-0@3.29.0-2ubuntu0.2

Overview

Affected versions of this package are vulnerable to Integer Overflow or Wraparound. SQLite through 3.32.0 has an integer overflow in sqlite3_str_vappendf in printf.c.

Remediation

Upgrade sqlite3 to version or higher.

References

medium severity

NULL Pointer Dereference

  • Vulnerable module: sqlite3/libsqlite3-0
  • Introduced through: sqlite3/libsqlite3-0@3.29.0-2ubuntu0.2
  • Fixed in: 3.29.0-2ubuntu0.3

Detailed paths

  • Introduced through: grafana/grafana:6.7.3-ubuntu@* sqlite3/libsqlite3-0@3.29.0-2ubuntu0.2

Overview

Affected versions of this package are vulnerable to NULL Pointer Dereference ext/fts3/fts3_snippet.c in SQLite before 3.32.0 has a NULL pointer dereference via a crafted matchinfo() query.

Remediation

Upgrade sqlite3 to version or higher.

References

medium severity

NULL Pointer Dereference

  • Vulnerable module: sqlite3/libsqlite3-0
  • Introduced through: sqlite3/libsqlite3-0@3.29.0-2ubuntu0.2
  • Fixed in: 3.29.0-2ubuntu0.3

Detailed paths

  • Introduced through: grafana/grafana:6.7.3-ubuntu@* sqlite3/libsqlite3-0@3.29.0-2ubuntu0.2

Overview

Affected versions of this package are vulnerable to NULL Pointer Dereference. SQLite through 3.32.0 has a segmentation fault in sqlite3ExprCodeTarget in expr.c.

Remediation

Upgrade sqlite3 to version or higher.

References

medium severity

Out-of-bounds Read

  • Vulnerable module: sqlite3/libsqlite3-0
  • Introduced through: sqlite3/libsqlite3-0@3.29.0-2ubuntu0.2

Detailed paths

  • Introduced through: grafana/grafana:6.7.3-ubuntu@* sqlite3/libsqlite3-0@3.29.0-2ubuntu0.2

Overview

Affected versions of this package are vulnerable to Out-of-bounds Read. An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 13.5 and iPadOS 13.5, macOS Catalina 10.15.5, tvOS 13.4.5, watchOS 6.2.5, iTunes 12.10.7 for Windows, iCloud for Windows 11.2, iCloud for Windows 7.19. A malicious application may cause a denial of service or potentially disclose memory contents.

Remediation

There is no fixed version for sqlite3.

References

medium severity

Out-of-bounds Write

  • Vulnerable module: sqlite3/libsqlite3-0
  • Introduced through: sqlite3/libsqlite3-0@3.29.0-2ubuntu0.2

Detailed paths

  • Introduced through: grafana/grafana:6.7.3-ubuntu@* sqlite3/libsqlite3-0@3.29.0-2ubuntu0.2

Overview

Affected versions of this package are vulnerable to Out-of-bounds Write. In SQLite before 3.32.3, select.c mishandles query-flattener optimization, leading to a multiSelectOrderBy heap overflow because of misuse of transitive properties for constant propagation.

Remediation

There is no fixed version for sqlite3.

References

medium severity

Use After Free

  • Vulnerable module: sqlite3/libsqlite3-0
  • Introduced through: sqlite3/libsqlite3-0@3.29.0-2ubuntu0.2
  • Fixed in: 3.29.0-2ubuntu0.3

Detailed paths

  • Introduced through: grafana/grafana:6.7.3-ubuntu@* sqlite3/libsqlite3-0@3.29.0-2ubuntu0.2

Overview

Affected versions of this package are vulnerable to Use After Free ext/fts3/fts3.c in SQLite before 3.32.0 has a use-after-free in fts3EvalNextRow, related to the snippet feature.

Remediation

Upgrade sqlite3 to version or higher.

References

medium severity

Information Exposure

  • Vulnerable module: systemd/libsystemd0
  • Introduced through: systemd/libsystemd0@242-7ubuntu3.7 and systemd/libudev1@242-7ubuntu3.7

Detailed paths

  • Introduced through: grafana/grafana:6.7.3-ubuntu@* systemd/libsystemd0@242-7ubuntu3.7
  • Introduced through: grafana/grafana:6.7.3-ubuntu@* systemd/libudev1@242-7ubuntu3.7

Overview

Affected versions of this package are vulnerable to Information Exposure systemd 242 changes the VT1 mode upon a logout, which allows attackers to read cleartext passwords in certain circumstances, such as watching a shutdown, or using Ctrl-Alt-F1 and Ctrl-Alt-F2. This occurs because the KDGKBMODE (aka current keyboard mode) check is mishandled.

Remediation

There is no fixed version for systemd.

References

low severity

Improper Check for Dropped Privileges

  • Vulnerable module: bash
  • Introduced through: bash@5.0-4ubuntu1

Detailed paths

  • Introduced through: grafana/grafana:6.7.3-ubuntu@* bash@5.0-4ubuntu1

Overview

Affected versions of this package are vulnerable to Improper Check for Dropped Privileges. An issue was discovered in disable_priv_mode in shell.c in GNU Bash through 5.0 patch 11. By default, if Bash is run with its effective UID not equal to its real UID, it will drop privileges by setting its effective UID to its real UID. However, it does so incorrectly. On Linux and other systems that support "saved UID" functionality, the saved UID is not dropped. An attacker with command execution in the shell can use "enable -f" for runtime loading of a new builtin, which can be a shared object that calls setuid() and therefore regains privileges. However, binaries running with an effective UID of 0 are unaffected.

Remediation

There is no fixed version for bash.

References

low severity

Improper Input Validation

  • Vulnerable module: coreutils
  • Introduced through: coreutils@8.30-3ubuntu2

Detailed paths

  • Introduced through: grafana/grafana:6.7.3-ubuntu@* coreutils@8.30-3ubuntu2

Overview

Affected versions of this package are vulnerable to Improper Input Validation chroot in GNU coreutils, when used with --userspec, allows local users to escape to the parent session via a crafted TIOCSTI ioctl call, which pushes characters to the terminal's input buffer.

Remediation

There is no fixed version for coreutils.

References

low severity

Directory Traversal

  • Vulnerable module: dpkg
  • Introduced through: dpkg@1.19.7ubuntu2

Detailed paths

  • Introduced through: grafana/grafana:6.7.3-ubuntu@* dpkg@1.19.7ubuntu2

Overview

Affected versions of this package are vulnerable to Directory Traversal dpkg-source in dpkg 1.3.0 through 1.18.23 is able to use a non-GNU patch program and does not offer a protection mechanism for blank-indented diff hunks, which allows remote attackers to conduct directory traversal attacks via a crafted Debian source package, as demonstrated by use of dpkg-source on NetBSD.

Details

A Directory Traversal attack (also known as path traversal) aims to access files and directories that are stored outside the intended folder. By manipulating files with "dot-dot-slash (../)" sequences and its variations, or by using absolute file paths, it may be possible to access arbitrary files and directories stored on file system, including application source code, configuration, and other critical system files.

Directory Traversal vulnerabilities can be generally divided into two types:

  • Information Disclosure: Allows the attacker to gain information about the folder structure or read the contents of sensitive files on the system.

st is a module for serving static files on web pages, and contains a vulnerability of this type. In our example, we will serve files from the public route.

If an attacker requests the following URL from our server, it will in turn leak the sensitive private key of the root user.

curl http://localhost:8080/public/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/root/.ssh/id_rsa

Note %2e is the URL encoded version of . (dot).

  • Writing arbitrary files: Allows the attacker to create or replace existing files. This type of vulnerability is also known as Zip-Slip.

One way to achieve this is by using a malicious zip archive that holds path traversal filenames. When each filename in the zip archive gets concatenated to the target extraction folder, without validation, the final path ends up outside of the target folder. If an executable or a configuration file is overwritten with a file containing malicious code, the problem can turn into an arbitrary code execution issue quite easily.

The following is an example of a zip archive with one benign file and one malicious file. Extracting the malicious file will result in traversing out of the target folder, ending up in /root/.ssh/ overwriting the authorized_keys file:

2018-04-15 22:04:29 .....           19           19  good.txt
2018-04-15 22:04:42 .....           20           20  ../../../../../../root/.ssh/authorized_keys

Remediation

There is no fixed version for dpkg.

References

low severity

Improper Input Validation

  • Vulnerable module: glibc/libc-bin
  • Introduced through: glibc/libc-bin@2.30-0ubuntu2.1 and glibc/libc6@2.30-0ubuntu2.1

Detailed paths

  • Introduced through: grafana/grafana:6.7.3-ubuntu@* glibc/libc-bin@2.30-0ubuntu2.1
  • Introduced through: grafana/grafana:6.7.3-ubuntu@* glibc/libc6@2.30-0ubuntu2.1

Overview

Affected versions of this package are vulnerable to Improper Input Validation. The iconv program in the GNU C Library (aka glibc or libc6) 2.31 and earlier, when invoked with multiple suffixes in the destination encoding (TRANSLATE or IGNORE) along with the -c option, enters an infinite loop when processing invalid multi-byte input sequences, leading to a denial of service.

Remediation

There is no fixed version for glibc.

References

low severity

Information Exposure

  • Vulnerable module: glibc/libc-bin
  • Introduced through: glibc/libc-bin@2.30-0ubuntu2.1 and glibc/libc6@2.30-0ubuntu2.1
  • Fixed in: 2.30-0ubuntu2.2

Detailed paths

  • Introduced through: grafana/grafana:6.7.3-ubuntu@* glibc/libc-bin@2.30-0ubuntu2.1
  • Introduced through: grafana/grafana:6.7.3-ubuntu@* glibc/libc6@2.30-0ubuntu2.1

Overview

Affected versions of this package are vulnerable to Information Exposure. On the x86-64 architecture, the GNU C Library (aka glibc) before 2.31 fails to ignore the LD_PREFER_MAP_32BIT_EXEC environment variable during program execution after a security transition, allowing local attackers to restrict the possible mapping addresses for loaded libraries and thus bypass ASLR for a setuid program.

Remediation

Upgrade glibc to version or higher.

References

low severity

Integer Underflow

  • Vulnerable module: glibc/libc-bin
  • Introduced through: glibc/libc-bin@2.30-0ubuntu2.1 and glibc/libc6@2.30-0ubuntu2.1

Detailed paths

  • Introduced through: grafana/grafana:6.7.3-ubuntu@* glibc/libc-bin@2.30-0ubuntu2.1
  • Introduced through: grafana/grafana:6.7.3-ubuntu@* glibc/libc6@2.30-0ubuntu2.1

Overview

Affected versions of this package are vulnerable to Integer Underflow. An exploitable signed comparison vulnerability exists in the ARMv7 memcpy() implementation of GNU glibc 2.30.9000. Calling memcpy() (on ARMv7 targets that utilize the GNU glibc implementation) with a negative value for the 'num' parameter results in a signed comparison vulnerability. If an attacker underflows the 'num' parameter to memcpy(), this vulnerability could lead to undefined behavior such as writing to out-of-bounds memory and potentially remote code execution. Furthermore, this memcpy() implementation allows for program execution to continue in scenarios where a segmentation fault or crash should have occurred. The dangers occur in that subsequent execution and iterations of this code will be executed with this corrupted data.

Remediation

There is no fixed version for glibc.

References

low severity

Use After Free

  • Vulnerable module: glibc/libc-bin
  • Introduced through: glibc/libc-bin@2.30-0ubuntu2.1 and glibc/libc6@2.30-0ubuntu2.1
  • Fixed in: 2.30-0ubuntu2.2

Detailed paths

  • Introduced through: grafana/grafana:6.7.3-ubuntu@* glibc/libc-bin@2.30-0ubuntu2.1
  • Introduced through: grafana/grafana:6.7.3-ubuntu@* glibc/libc6@2.30-0ubuntu2.1

Overview

Affected versions of this package are vulnerable to Use After Free. A use-after-free vulnerability introduced in glibc upstream version 2.14 was found in the way the tilde expansion was carried out. Directory paths containing an initial tilde followed by a valid username were affected by this issue. A local attacker could exploit this flaw by creating a specially crafted path that, when processed by the glob function, would potentially lead to arbitrary code execution. This was fixed in version 2.32.

Remediation

Upgrade glibc to version or higher.

References

low severity

Improper Validation of Certificate with Host Mismatch

  • Vulnerable module: gnupg2/gpgv
  • Introduced through: gnupg2/gpgv@2.2.12-1ubuntu3

Detailed paths

  • Introduced through: grafana/grafana:6.7.3-ubuntu@* gnupg2/gpgv@2.2.12-1ubuntu3

Overview

Affected versions of this package are vulnerable to Improper Validation of Certificate with Host Mismatch. Interaction between the sks-keyserver code through 1.2.0 of the SKS keyserver network, and GnuPG through 2.2.16, makes it risky to have a GnuPG keyserver configuration line referring to a host on the SKS keyserver network. Retrieving data from this network may cause a persistent denial of service, because of a Certificate Spamming Attack.

Remediation

There is no fixed version for gnupg2.

References

low severity

Use of a Broken or Risky Cryptographic Algorithm

  • Vulnerable module: gnupg2/gpgv
  • Introduced through: gnupg2/gpgv@2.2.12-1ubuntu3

Detailed paths

  • Introduced through: grafana/grafana:6.7.3-ubuntu@* gnupg2/gpgv@2.2.12-1ubuntu3

Overview

Affected versions of this package are vulnerable to Use of a Broken or Risky Cryptographic Algorithm. A flaw was found in the way certificate signatures could be forged using collisions found in the SHA-1 algorithm. An attacker could use this weakness to create forged certificate signatures. This issue affects GnuPG versions before 2.2.18.

Remediation

There is no fixed version for gnupg2.

References

low severity

Integer Overflow or Wraparound

  • Vulnerable module: krb5/krb5-locales
  • Introduced through: krb5/krb5-locales@1.17-6, krb5/libgssapi-krb5-2@1.17-6 and others

Detailed paths

  • Introduced through: grafana/grafana:6.7.3-ubuntu@* krb5/krb5-locales@1.17-6
  • Introduced through: grafana/grafana:6.7.3-ubuntu@* krb5/libgssapi-krb5-2@1.17-6
  • Introduced through: grafana/grafana:6.7.3-ubuntu@* krb5/libk5crypto3@1.17-6
  • Introduced through: grafana/grafana:6.7.3-ubuntu@* krb5/libkrb5-3@1.17-6
  • Introduced through: grafana/grafana:6.7.3-ubuntu@* krb5/libkrb5support0@1.17-6

Overview

Affected versions of this package are vulnerable to Integer Overflow or Wraparound. An issue was discovered in MIT Kerberos 5 (aka krb5) through 1.16. There is a variable "dbentry->n_key_data" in kadmin/dbutil/dump.c that can store 16-bit data but unknowingly the developer has assigned a "u4" variable to it, which is for 32-bit data. An attacker can use this vulnerability to affect other artifacts of the database as we know that a Kerberos database dump file contains trusted data.

Remediation

There is no fixed version for krb5.

References

low severity

Cryptographic Issues

  • Vulnerable module: libgcrypt20
  • Introduced through: libgcrypt20@1.8.4-5ubuntu2.1

Detailed paths

  • Introduced through: grafana/grafana:6.7.3-ubuntu@* libgcrypt20@1.8.4-5ubuntu2.1

Overview

Affected versions of this package are vulnerable to Cryptographic Issues. ** DISPUTED ** In Libgcrypt 1.8.4, the C implementation of AES is vulnerable to a flush-and-reload side-channel attack because physical addresses are available to other processes. (The C implementation is used on platforms where an assembly-language implementation is unavailable.) NOTE: the vendor's position is that the issue report cannot be validated because there is no description of an attack.

Remediation

There is no fixed version for libgcrypt20.

References

low severity

Resource Management Errors

  • Vulnerable module: libtasn1-6
  • Introduced through: libtasn1-6@4.14-3

Detailed paths

  • Introduced through: grafana/grafana:6.7.3-ubuntu@* libtasn1-6@4.14-3

Overview

Affected versions of this package are vulnerable to Resource Management Errors. GNU Libtasn1-4.13 libtasn1-4.13 version libtasn1-4.13, libtasn1-4.12 contains a DoS, specifically CPU usage will reach 100% when running asn1Paser against the POC due to an issue in _asn1_expand_object_id(p_tree), after a long time, the program will be killed. This attack appears to be exploitable via parsing a crafted file.

Remediation

There is no fixed version for libtasn1-6.

References

low severity

Buffer Overflow

  • Vulnerable module: lz4/liblz4-1
  • Introduced through: lz4/liblz4-1@1.9.1-1

Detailed paths

  • Introduced through: grafana/grafana:6.7.3-ubuntu@* lz4/liblz4-1@1.9.1-1

Overview

Affected versions of this package are vulnerable to Buffer Overflow. LZ4 before 1.9.2 has a heap-based buffer overflow in LZ4_write32 (related to LZ4_compress_destSize), affecting applications that call LZ4_compress_fast with a large input. (This issue can also lead to data corruption.) NOTE: the vendor states "only a few specific / uncommon usages of the API are at risk."

Remediation

There is no fixed version for lz4.

References

low severity

Out-of-bounds Read

  • Vulnerable module: ncurses/libncurses6
  • Introduced through: ncurses/libncurses6@6.1+20190803-1ubuntu1, ncurses/libncursesw6@6.1+20190803-1ubuntu1 and others

Detailed paths

  • Introduced through: grafana/grafana:6.7.3-ubuntu@* ncurses/libncurses6@6.1+20190803-1ubuntu1
  • Introduced through: grafana/grafana:6.7.3-ubuntu@* ncurses/libncursesw6@6.1+20190803-1ubuntu1
  • Introduced through: grafana/grafana:6.7.3-ubuntu@* ncurses/libtinfo6@6.1+20190803-1ubuntu1
  • Introduced through: grafana/grafana:6.7.3-ubuntu@* ncurses/ncurses-base@6.1+20190803-1ubuntu1
  • Introduced through: grafana/grafana:6.7.3-ubuntu@* ncurses/ncurses-bin@6.1+20190803-1ubuntu1

Overview

Affected versions of this package are vulnerable to Out-of-bounds Read. There is a heap-based buffer over-read in the fmt_entry function in tinfo/comp_hash.c in the terminfo library in ncurses before 6.1-20191012.

Remediation

There is no fixed version for ncurses.

References

low severity

Out-of-bounds Read

  • Vulnerable module: ncurses/libncurses6
  • Introduced through: ncurses/libncurses6@6.1+20190803-1ubuntu1, ncurses/libncursesw6@6.1+20190803-1ubuntu1 and others

Detailed paths

  • Introduced through: grafana/grafana:6.7.3-ubuntu@* ncurses/libncurses6@6.1+20190803-1ubuntu1
  • Introduced through: grafana/grafana:6.7.3-ubuntu@* ncurses/libncursesw6@6.1+20190803-1ubuntu1
  • Introduced through: grafana/grafana:6.7.3-ubuntu@* ncurses/libtinfo6@6.1+20190803-1ubuntu1
  • Introduced through: grafana/grafana:6.7.3-ubuntu@* ncurses/ncurses-base@6.1+20190803-1ubuntu1
  • Introduced through: grafana/grafana:6.7.3-ubuntu@* ncurses/ncurses-bin@6.1+20190803-1ubuntu1

Overview

Affected versions of this package are vulnerable to Out-of-bounds Read. There is a heap-based buffer over-read in the _nc_find_entry function in tinfo/comp_hash.c in the terminfo library in ncurses before 6.1-20191012.

Remediation

There is no fixed version for ncurses.

References

low severity

Improper Initialization

  • Vulnerable module: openldap/libldap-2.4-2
  • Introduced through: openldap/libldap-2.4-2@2.4.48+dfsg-1ubuntu1 and openldap/libldap-common@2.4.48+dfsg-1ubuntu1

Detailed paths

  • Introduced through: grafana/grafana:6.7.3-ubuntu@* openldap/libldap-2.4-2@2.4.48+dfsg-1ubuntu1
  • Introduced through: grafana/grafana:6.7.3-ubuntu@* openldap/libldap-common@2.4.48+dfsg-1ubuntu1

Overview

Affected versions of this package are vulnerable to Improper Initialization slapd in OpenLDAP 2.4.45 and earlier creates a PID file after dropping privileges to a non-root account, which might allow local users to kill arbitrary processes by leveraging access to this non-root account for PID file modification before a root script executes a "kill cat /pathname" command, as demonstrated by openldap-initscript.

Remediation

There is no fixed version for openldap.

References

low severity

Information Exposure

  • Vulnerable module: openssl
  • Introduced through: openssl@1.1.1c-1ubuntu4 and openssl/libssl1.1@1.1.1c-1ubuntu4
  • Fixed in: 1.1.1c-1ubuntu4.1

Detailed paths

  • Introduced through: grafana/grafana:6.7.3-ubuntu@* openssl@1.1.1c-1ubuntu4
  • Introduced through: grafana/grafana:6.7.3-ubuntu@* openssl/libssl1.1@1.1.1c-1ubuntu4

Overview

Affected versions of this package are vulnerable to Information Exposure. There is an overflow bug in the x64_64 Montgomery squaring procedure used in exponentiation with 512-bit moduli. No EC algorithms are affected. Analysis suggests that attacks against 2-prime RSA1024, 3-prime RSA1536, and DSA1024 as a result of this defect would be very difficult to perform and are not believed likely. Attacks against DH512 are considered just feasible. However, for an attack the target would have to re-use the DH512 private key, which is not recommended anyway. Also applications directly using the low level API BN_mod_exp may be affected if they use BN_FLG_CONSTTIME. Fixed in OpenSSL 1.1.1e (Affected 1.1.1-1.1.1d). Fixed in OpenSSL 1.0.2u (Affected 1.0.2-1.0.2t).

Remediation

Upgrade openssl to version or higher.

References

low severity

Missing Encryption of Sensitive Data

  • Vulnerable module: openssl
  • Introduced through: openssl@1.1.1c-1ubuntu4 and openssl/libssl1.1@1.1.1c-1ubuntu4
  • Fixed in: 1.1.1c-1ubuntu4.1

Detailed paths

  • Introduced through: grafana/grafana:6.7.3-ubuntu@* openssl@1.1.1c-1ubuntu4
  • Introduced through: grafana/grafana:6.7.3-ubuntu@* openssl/libssl1.1@1.1.1c-1ubuntu4

Overview

Affected versions of this package are vulnerable to Missing Encryption of Sensitive Data. Normally in OpenSSL EC groups always have a co-factor present and this is used in side channel resistant code paths. However, in some cases, it is possible to construct a group using explicit parameters (instead of using a named curve). In those cases it is possible that such a group does not have the cofactor present. This can occur even where all the parameters match a known named curve. If such a curve is used then OpenSSL falls back to non-side channel resistant code paths which may result in full key recovery during an ECDSA signature operation. In order to be vulnerable an attacker would have to have the ability to time the creation of a large number of signatures where explicit parameters with no co-factor present are in use by an application using libcrypto. For the avoidance of doubt libssl is not vulnerable because explicit parameters are never used. Fixed in OpenSSL 1.1.1d (Affected 1.1.1-1.1.1c). Fixed in OpenSSL 1.1.0l (Affected 1.1.0-1.1.0k). Fixed in OpenSSL 1.0.2t (Affected 1.0.2-1.0.2s).

Remediation

Upgrade openssl to version or higher.

References

low severity

Missing Encryption of Sensitive Data

  • Vulnerable module: openssl
  • Introduced through: openssl@1.1.1c-1ubuntu4 and openssl/libssl1.1@1.1.1c-1ubuntu4
  • Fixed in: 1.1.1c-1ubuntu4.1

Detailed paths

  • Introduced through: grafana/grafana:6.7.3-ubuntu@* openssl@1.1.1c-1ubuntu4
  • Introduced through: grafana/grafana:6.7.3-ubuntu@* openssl/libssl1.1@1.1.1c-1ubuntu4

Overview

Affected versions of this package are vulnerable to Missing Encryption of Sensitive Data. In situations where an attacker receives automated notification of the success or failure of a decryption attempt an attacker, after sending a very large number of messages to be decrypted, can recover a CMS/PKCS7 transported encryption key or decrypt any RSA encrypted message that was encrypted with the public RSA key, using a Bleichenbacher padding oracle attack. Applications are not affected if they use a certificate together with the private RSA key to the CMS_decrypt or PKCS7_decrypt functions to select the correct recipient info to decrypt. Fixed in OpenSSL 1.1.1d (Affected 1.1.1-1.1.1c). Fixed in OpenSSL 1.1.0l (Affected 1.1.0-1.1.0k). Fixed in OpenSSL 1.0.2t (Affected 1.0.2-1.0.2s).

Remediation

Upgrade openssl to version or higher.

References

low severity

Use of Insufficiently Random Values

  • Vulnerable module: openssl
  • Introduced through: openssl@1.1.1c-1ubuntu4 and openssl/libssl1.1@1.1.1c-1ubuntu4
  • Fixed in: 1.1.1c-1ubuntu4.1

Detailed paths

  • Introduced through: grafana/grafana:6.7.3-ubuntu@* openssl@1.1.1c-1ubuntu4
  • Introduced through: grafana/grafana:6.7.3-ubuntu@* openssl/libssl1.1@1.1.1c-1ubuntu4

Overview

Affected versions of this package are vulnerable to Use of Insufficiently Random Values. OpenSSL 1.1.1 introduced a rewritten random number generator (RNG). This was intended to include protection in the event of a fork() system call in order to ensure that the parent and child processes did not share the same RNG state. However this protection was not being used in the default case. A partial mitigation for this issue is that the output from a high precision timer is mixed into the RNG state so the likelihood of a parent and child process sharing state is significantly reduced. If an application already calls OPENSSL_init_crypto() explicitly using OPENSSL_INIT_ATFORK then this problem does not occur at all. Fixed in OpenSSL 1.1.1d (Affected 1.1.1-1.1.1c).

Remediation

Upgrade openssl to version or higher.

References

low severity

Out-of-bounds Read

  • Vulnerable module: pcre2/libpcre2-8-0
  • Introduced through: pcre2/libpcre2-8-0@10.32-5

Detailed paths

  • Introduced through: grafana/grafana:6.7.3-ubuntu@* pcre2/libpcre2-8-0@10.32-5

Overview

Affected versions of this package are vulnerable to Out-of-bounds Read. An out-of-bounds read was discovered in PCRE before 10.34 when the pattern \X is JIT compiled and used to match specially crafted subjects in non-UTF mode. Applications that use PCRE to parse untrusted input may be vulnerable to this flaw, which would allow an attacker to crash the application. The flaw occurs in do_extuni_no_utf in pcre2_jit_compile.c.

Remediation

There is no fixed version for pcre2.

References

low severity

Integer Overflow or Wraparound

  • Vulnerable module: pcre3/libpcre3
  • Introduced through: pcre3/libpcre3@2:8.39-12

Detailed paths

  • Introduced through: grafana/grafana:6.7.3-ubuntu@* pcre3/libpcre3@2:8.39-12

Overview

Affected versions of this package are vulnerable to Integer Overflow or Wraparound libpcre in PCRE before 8.44 allows an integer overflow via a large number after a (?C substring.

Remediation

There is no fixed version for pcre3.

References

low severity

Out-of-bounds Read

  • Vulnerable module: pcre3/libpcre3
  • Introduced through: pcre3/libpcre3@2:8.39-12

Detailed paths

  • Introduced through: grafana/grafana:6.7.3-ubuntu@* pcre3/libpcre3@2:8.39-12

Overview

Affected versions of this package are vulnerable to Out-of-bounds Read libpcre in PCRE before 8.43 allows a subject buffer over-read in JIT when UTF is disabled, and \X or \R has more than one fixed quantifier, a related issue to CVE-2019-20454.

Remediation

There is no fixed version for pcre3.

References

low severity

Uncontrolled Recursion

  • Vulnerable module: pcre3/libpcre3
  • Introduced through: pcre3/libpcre3@2:8.39-12

Detailed paths

  • Introduced through: grafana/grafana:6.7.3-ubuntu@* pcre3/libpcre3@2:8.39-12

Overview

Affected versions of this package are vulnerable to Uncontrolled Recursion. In PCRE 8.41, the OP_KETRMAX feature in the match function in pcre_exec.c allows stack exhaustion (uncontrolled recursion) when processing a crafted regular expression.

Remediation

There is no fixed version for pcre3.

References

low severity

Buffer Overflow

  • Vulnerable module: perl/perl-base
  • Introduced through: perl/perl-base@5.28.1-6build1

Detailed paths

  • Introduced through: grafana/grafana:6.7.3-ubuntu@* perl/perl-base@5.28.1-6build1

Overview

Affected versions of this package are vulnerable to Buffer Overflow regcomp.c in Perl before 5.30.3 allows a buffer overflow via a crafted regular expression because of recursive S_study_chunk calls. An application written in Perl would only be vulnerable to this flaw if it evaluates regular expressions supplied by the attacker. Evaluating regular expressions in this fashion is known to be dangerous since the regular expression engine does not protect against denial of service attacks in this usage scenario.]

Remediation

There is no fixed version for perl.

References

low severity

Integer Overflow or Wraparound

  • Vulnerable module: perl/perl-base
  • Introduced through: perl/perl-base@5.28.1-6build1

Detailed paths

  • Introduced through: grafana/grafana:6.7.3-ubuntu@* perl/perl-base@5.28.1-6build1

Overview

Affected versions of this package are vulnerable to Integer Overflow or Wraparound. Perl before 5.30.3 has an integer overflow related to mishandling of a "PL_regkind[OP(n)] == NOTHING" situation. A crafted regular expression could lead to malformed bytecode with a possibility of instruction injection. An application written in Perl would only be vulnerable to this flaw if it evaluates regular expressions supplied by the attacker. Evaluating regular expressions in this fashion is known to be dangerous since the regular expression engine does not protect against denial of service attacks in this usage scenario.]

Remediation

There is no fixed version for perl.

References

low severity

Out-of-bounds Write

  • Vulnerable module: perl/perl-base
  • Introduced through: perl/perl-base@5.28.1-6build1

Detailed paths

  • Introduced through: grafana/grafana:6.7.3-ubuntu@* perl/perl-base@5.28.1-6build1

Overview

Affected versions of this package are vulnerable to Out-of-bounds Write. Perl before 5.30.3 on 32-bit platforms allows a heap-based buffer overflow because nested regular expression quantifiers have an integer overflow. An application written in Perl would only be vulnerable to this flaw if it evaluates regular expressions supplied by the attacker. Evaluating regular expressions in this fashion is known to be dangerous since the regular expression engine does not protect against denial of service attacks in this usage scenario. Additionally, the target system needs a sufficient amount of memory to allocate partial expansions of the nested quantifiers prior to the overflow occurring. This requirement is unlikely to be met on 64bit systems.]

Remediation

There is no fixed version for perl.

References

low severity

Incorrect Permission Assignment for Critical Resource

  • Vulnerable module: shadow/login
  • Introduced through: shadow/login@1:4.5-1.1ubuntu4 and shadow/passwd@1:4.5-1.1ubuntu4

Detailed paths

  • Introduced through: grafana/grafana:6.7.3-ubuntu@* shadow/login@1:4.5-1.1ubuntu4
  • Introduced through: grafana/grafana:6.7.3-ubuntu@* shadow/passwd@1:4.5-1.1ubuntu4

Overview

Affected versions of this package are vulnerable to Incorrect Permission Assignment for Critical Resource. An issue was discovered in shadow 4.5. newgidmap (in shadow-utils) is setuid and allows an unprivileged user to be placed in a user namespace where setgroups(2) is permitted. This allows an attacker to remove themselves from a supplementary group, which may allow access to certain filesystem paths if the administrator has used "group blacklisting" (e.g., chmod g-rwx) to restrict access to paths. This flaw effectively reverts a security feature in the kernel (in particular, the /proc/self/setgroups knob) to prevent this sort of privilege escalation.

Remediation

There is no fixed version for shadow.

References

low severity

Time-of-check Time-of-use (TOCTOU)

  • Vulnerable module: shadow/login
  • Introduced through: shadow/login@1:4.5-1.1ubuntu4 and shadow/passwd@1:4.5-1.1ubuntu4

Detailed paths

  • Introduced through: grafana/grafana:6.7.3-ubuntu@* shadow/login@1:4.5-1.1ubuntu4
  • Introduced through: grafana/grafana:6.7.3-ubuntu@* shadow/passwd@1:4.5-1.1ubuntu4

Overview

Affected versions of this package are vulnerable to Time-of-check Time-of-use (TOCTOU) shadow: TOCTOU (time-of-check time-of-use) race condition when copying and removing directory trees

Remediation

There is no fixed version for shadow.

References

low severity

CVE-2019-19603

  • Vulnerable module: sqlite3/libsqlite3-0
  • Introduced through: sqlite3/libsqlite3-0@3.29.0-2ubuntu0.2
  • Fixed in: 3.29.0-2ubuntu0.3

Detailed paths

  • Introduced through: grafana/grafana:6.7.3-ubuntu@* sqlite3/libsqlite3-0@3.29.0-2ubuntu0.2

Overview

Affected versions of this package are vulnerable to CVE-2019-19603. SQLite 3.30.1 mishandles certain SELECT statements with a nonexistent VIEW, leading to an application crash.

Remediation

Upgrade sqlite3 to version or higher.

References

low severity

CVE-2020-13631

  • Vulnerable module: sqlite3/libsqlite3-0
  • Introduced through: sqlite3/libsqlite3-0@3.29.0-2ubuntu0.2
  • Fixed in: 3.29.0-2ubuntu0.3

Detailed paths

  • Introduced through: grafana/grafana:6.7.3-ubuntu@* sqlite3/libsqlite3-0@3.29.0-2ubuntu0.2

Overview

Affected versions of this package are vulnerable to CVE-2020-13631. SQLite before 3.32.0 allows a virtual table to be renamed to the name of one of its shadow tables, related to alter.c and build.c.

Remediation

Upgrade sqlite3 to version or higher.

References

low severity

Improper Input Validation

  • Vulnerable module: sqlite3/libsqlite3-0
  • Introduced through: sqlite3/libsqlite3-0@3.29.0-2ubuntu0.2
  • Fixed in: 3.29.0-2ubuntu0.3

Detailed paths

  • Introduced through: grafana/grafana:6.7.3-ubuntu@* sqlite3/libsqlite3-0@3.29.0-2ubuntu0.2

Overview

Affected versions of this package are vulnerable to Improper Input Validation. SQLite through 3.31.1 allows attackers to cause a denial of service (segmentation fault) via a malformed window-function query because the AggInfo object's initialization is mishandled.

Remediation

Upgrade sqlite3 to version or higher.

References

low severity

Uncontrolled Recursion

  • Vulnerable module: sqlite3/libsqlite3-0
  • Introduced through: sqlite3/libsqlite3-0@3.29.0-2ubuntu0.2
  • Fixed in: 3.29.0-2ubuntu0.3

Detailed paths

  • Introduced through: grafana/grafana:6.7.3-ubuntu@* sqlite3/libsqlite3-0@3.29.0-2ubuntu0.2

Overview

Affected versions of this package are vulnerable to Uncontrolled Recursion alter.c in SQLite through 3.30.1 allows attackers to trigger infinite recursion via certain types of self-referential views in conjunction with ALTER TABLE statements.

Remediation

Upgrade sqlite3 to version or higher.

References

low severity

Improper Input Validation

  • Vulnerable module: systemd/libsystemd0
  • Introduced through: systemd/libsystemd0@242-7ubuntu3.7 and systemd/libudev1@242-7ubuntu3.7

Detailed paths

  • Introduced through: grafana/grafana:6.7.3-ubuntu@* systemd/libsystemd0@242-7ubuntu3.7
  • Introduced through: grafana/grafana:6.7.3-ubuntu@* systemd/libudev1@242-7ubuntu3.7

Overview

Affected versions of this package are vulnerable to Improper Input Validation systemd through v245 mishandles numerical usernames such as ones composed of decimal digits or 0x followed by hex digits, as demonstrated by use of root privileges when privileges of the 0x0 user account were intended. NOTE: this issue exists because of an incomplete fix for CVE-2017-1000082.

Remediation

There is no fixed version for systemd.

References

low severity

NULL Pointer Dereference

  • Vulnerable module: tar
  • Introduced through: tar@1.30+dfsg-6

Detailed paths

  • Introduced through: grafana/grafana:6.7.3-ubuntu@* tar@1.30+dfsg-6

Overview

Affected versions of this package are vulnerable to NULL Pointer Dereference pax_decode_header in sparse.c in GNU Tar before 1.32 had a NULL pointer dereference when parsing certain archives that have malformed extended headers.

Remediation

There is no fixed version for tar.

References