CVE-2020-12458
Fixed in a distro release EPSS <1%
An information-disclosure flaw was found in Grafana through 6.7.3. The database directory /var/lib/grafana and database file /var/lib/grafana/grafana.db are world readable. This can result in exposure of sensitive information (e.g., cleartext or encrypted datasource passwords).
Products: grafana, redhat ceph_storage, redhat enterprise_linux, fedoraproject fedora
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Go | github.com/grafana/grafana | 7.2.1 |
| Go | github.com/grafana/grafana | no fix |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| AlmaLinux 8 | grafana | 6.7.4-3.el8 |
| AlmaLinux 8 | grafana-azure-monitor | 6.7.4-3.el8 |
| AlmaLinux 8 | grafana-cloudwatch | 6.7.4-3.el8 |
| AlmaLinux 8 | grafana-elasticsearch | 6.7.4-3.el8 |
| AlmaLinux 8 | grafana-graphite | 6.7.4-3.el8 |
| AlmaLinux 8 | grafana-influxdb | 6.7.4-3.el8 |
| AlmaLinux 8 | grafana-loki | 6.7.4-3.el8 |
| AlmaLinux 8 | grafana-mssql | 6.7.4-3.el8 |
| AlmaLinux 8 | grafana-mysql | 6.7.4-3.el8 |
| AlmaLinux 8 | grafana-opentsdb | 6.7.4-3.el8 |
| AlmaLinux 8 | grafana-postgres | 6.7.4-3.el8 |
| AlmaLinux 8 | grafana-prometheus | 6.7.4-3.el8 |
| AlmaLinux 8 | grafana-stackdriver | 6.7.4-3.el8 |
| Chainguard | grafana-fips-11.6 | 0 |
| Chainguard | grafana-fips-12.0 | 12.0.10-r6 |
| Chainguard | grafana-fips-12.1 | 12.1.10.01-r3 |
| Chainguard | grafana-fips-12.2 | 0 |
| Chainguard | grafana-fips-12.3 | 0 |
| Chainguard | grafana-fips-12.4 | 0 |
| Chainguard | grafana-fips-13.0 | 0 |
| Chainguard | grafana-fips-13.1 | 13.1.0-r0 |
| Red Hat Enterprise Linux 8 | grafana | 0:6.7.4-3.el8 |
| Red Hat Enterprise Linux 8 | grafana-azure-monitor | 0:6.7.4-3.el8 |
| Red Hat Enterprise Linux 8 | grafana-cloudwatch | 0:6.7.4-3.el8 |
| Red Hat Enterprise Linux 8 | grafana-debuginfo | 0:6.7.4-3.el8 |
| Red Hat Enterprise Linux 8 | grafana-elasticsearch | 0:6.7.4-3.el8 |
| Red Hat Enterprise Linux 8 | grafana-graphite | 0:6.7.4-3.el8 |
| Red Hat Enterprise Linux 8 | grafana-influxdb | 0:6.7.4-3.el8 |
| Red Hat Enterprise Linux 8 | grafana-loki | 0:6.7.4-3.el8 |
| Red Hat Enterprise Linux 8 | grafana-mssql | 0:6.7.4-3.el8 |
| Red Hat Enterprise Linux 8 | grafana-mysql | 0:6.7.4-3.el8 |
| Red Hat Enterprise Linux 8 | grafana-opentsdb | 0:6.7.4-3.el8 |
| Red Hat Enterprise Linux 8 | grafana-postgres | 0:6.7.4-3.el8 |
| Red Hat Enterprise Linux 8 | grafana-prometheus | 0:6.7.4-3.el8 |
| Red Hat Enterprise Linux 8 | grafana-stackdriver | 0:6.7.4-3.el8 |
| Ubuntu 16.04 LTS | grafana | no fix |