SUSE-SU-2023:2915-1: grafana&distro=SUSE Manager Client Tools 15 SUSE Linux Enterprise

Published

Published 20-07-2023Last modified 04-02-2026

Vulnerability summary

SUSE-SU-2023:2915-1 is a vulnerability in grafana&distro=SUSE Manager Client Tools 15 SUSE Linux Enterprise with no CVSS score yet.

Priority

Insufficient evidence

No CVSS vector published; no exploitation reported by the 5 checked sources

Source freshness unavailable

How is this decided?

CVSS score

Not scored

010

No CVSS score recorded

EPSS scoreNot scoredRisk metrics not yet published.

KEVNot listedNot listed by any tracked catalog.

RansomwareNot flaggedNo ransomware use recorded.

Public exploits0No public exploits recorded

Advisory lineage

Upstream 3 · Downstream 0 · Related 3

CVE-2023-2183 CVE-2023-2801 CVE-2023-3128

Timeline

20-07-2023
PublishedVulnerability first disclosed.
04-02-2026
Last modifiedVulnerability information updated.

Description

Security update for SUSE Manager Client Tools This update fixes the following issues: grafana: - Update to version 9.5.5: * CVE-2023-3128: Fix authentication bypass using Azure AD OAuth (bsc#1212641, jsc#PED-3694) * Bug fixes: * Auth: Show invite button if disable login form is set to false. * Azure: Fix Kusto auto-completion for Azure datasources. * RBAC: Remove legacy AC editor and admin role on new dashboard route. * API: Revert allowing editors to access GET /datasources. * Settings: Add ability to override skip_org_role_sync with Env variables. - Update to version 9.5.3: * CVE-2023-2801: Query: Prevent crash while executing concurrent mixed queries (bsc#1212099) * CVE-2023-2183: Alerting: Require alert.notifications:write permissions to test receivers and templates (bsc#1212100) - Update to version 9.5.2: Alerting: Scheduler use rule fingerprint instead of version. Explore: Update table min height. DataLinks: Encoded URL fixed. TimeSeries: Fix leading null-fill for missing intervals. Dashboard: Revert fixed header shown on mobile devices in the new panel header. PostgreSQL: Fix TLS certificate issue by downgrading lib/pq. Provisioning: Fix provisioning issues with legacy alerting and data source permissions. Alerting: Fix misleading status code in provisioning API. Loki: Fix log samples using `instant` queries. Panel Header: Implement new Panel Header on Angular Panels. Azure Monitor: Fix bug that was not showing resources for certain locations. Alerting: Fix panic when reparenting receivers to groups following an attempted rename via Provisioning. Cloudwatch Logs: Clarify Cloudwatch Logs Limits. - Update to 9.5.1 Loki Variable Query Editor: Fix bug when the query is updated Expressions: Fix expression load with legacy UID -100

CVSS metrics

Risk metrics not yet published.

EPSS trend

No EPSS score has been published for this record yet.

Known exploited

Compare KEV catalogs

CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

No weakness data has been published for this record.

Affected systems

Version check

Known conditions: not stated in public data.

Suse1 product

grafana&distro=SUSE Manager Client Tools 15< 9.5.5-150000.1.51.1

1 vendor · 1 product

References

7 links

Related vulnerabilities

Insufficient evidenceSUSE-SU-2026:3714-1SUSE Linux Enterprisesuse · golang-github-prometheus-alertmanager&distro=SUSE Manager Client Tools 15 +2 more2mo agosuse golang-github-prometheus-alertmanager&distro=SUSE Manager Client Tools 15Security update for Multi-Linux Manager Monitoring stack This update fixes the following issues: prometheus-postgres_exporter: - CVE-2022-21698: Replace github.com/prometheus/client_golang with version 1.11.1 and prevent validation bypass and privilege escalation (bsc#1248699) golang-github-prometheus-alertmanager: - CVE-2026-39821: Fix validation bypass and privilege escalation by updating golang.org/x/net to version 0.55.0 (bsc#1266615) golang-github-prometheus-prometheus was updated from version 3.5.3 to 3.5.4: Security fixes: - CVE-2026-39882: Fix reading unbounded HTTP response bodies by bumping OpenTelemetry to 1.43.0 (bsc#1274221) - CVE-2026-33244: Fixed improper neutralization of the HTTP Location header value in react-router (bsc#1267416) - CVE-2026-13149: Prevent potential DoS by bumping brace-expansion to version 5.0.7 (bsc#1269917) - CVE-2026-33814: Fixed infinite loop in HTTP/2 transport (bsc#1265827) Other changes and fixes: - STACKIT SD: Fixed secrets being exposed in plaintext via /-/config endpoint - Chore: Bump golang.org/x/net to version 0.55.0 grafana updated from version 11.6.14+security04 to version 12.4.5: Security fixes: - CVE-2026-33382: Limit the size of the request body before processing it at several Grafana API endpoints (bsc#1271331) - CVE-2026-39882: Prevent memory exhaustion DoS in OpenTelemetry OTLP HTTP exporters (bsc#1274217) - CVE-2025-12141: Fixed information leakage in Grafana Alerting (bsc#1262187) - CVE-2026-41607: Fix potential information disclosure in Apache Thrift (bsc#1263272) Breaking chahnges introduced in version 12.0.0: - BREAKING: Removed AngularJS and all deprecated UI Extensions APIs. - BREAKING: Enforced stricter version compatibility checks in plugin CLI install commands. - BREAKING: Enabled the failWrongDSUID feature flag by default, which rejects data sources with incorrect UIDs. Other changes introduced from version 11.6.14+security04 to version 12.4.5 (jsc#PED-16512): - Add Legal-Review-Notice (bsc#1271327) - Datasources: return 400 when payload UID does not match URL UID in PUT /api/datasources/uid/:uid - Analytics: Keep internal dashboard id. - Reporting: Correctly apply appSubURL to report settings requests - Alerting: Document Grafana HA Alertmanager cluster metrics prefix change. - Dependency updates to core plugins and UI libraries. - Updates to data source provisioning and dashboard schemas. - Introduced dynamic dashboards in public preview. - Added a new side toolbar that replaces the second top toolbar to provide additional vertical space. - Added the ability to create dashboards from templates using sample data. - Revamped the gauge visualization with rounded bars, configurable bar thickness, and endpoint markers. - Added support to map one variable to multiple values. - Released a completely redesigned logs visualization. - Added the ability to export dashboards directly as PNG images. - Introduced an interactive learning experience within the Grafana UI. - Added a Switch template variable type to quickly toggle between values in queries. - Added functionality to style table cells using CSS properties via the field cell option. - Added support for Entra Workload Identity to enhance authentication capabilities with federated credentials. - Redesigned the alert rule list page. - Renamed Mute Timings to Active Time Intervals in Grafana Alerting. - Added support for Service Account Impersonation in the BigQuery data source. - Introduced the Grafana Advisor in public preview. - Introduced a new dashboard schema to replace the original single grid layout. - MIGRATION: Triggered a full-table rewrite for the annotation table, which may temporarily increase disk usage.CVSSUnscored Insufficient evidenceSUSE-SU-2026:1013-1opensuse · dracut-saltboot&distro=openSUSE Leap 15.6 +20 more7mo agoopensuse dracut-saltboot&distro=openSUSE Leap 15.6Security update 5.0.7 for Multi-Linux Manager Client Tools This update fixes the following issues: dracut-saltboot: - Version update to 1.1.0: * Retry DHCP requests up to 3 times (bsc#1253004) golang-github-QubitProducts-exporter_exporter: - Non-customer-facing optimization and update golang-github-boynux-squid_exporter: - Version update from 1.6.0 to 1.13.0 with the following highlighted changes and fixes (jsc#PED-14971): * Added compatibility for Squid 6 and support for the squid-internal-mgr metrics path * Added TLS and Basic Authentication to the exporter’s web interface * Added support for the exporter to authenticate against the Squid proxy itself * Allow the gathering of process information without requiring root privileges * The exporter can now be configured using environment variables * Added support for custom labels to all exported metrics for better data filtering * New metrics to track if Squid is running (squid_up), how long a scrape takes, and if any errors occurred * Added 'service time' metrics to analyze proxy speed and performance. * Added a metric for open file descriptors (process_open_fds) to help prevent connection bottlenecks * Corrected the squid_client_http_requests_total metric to ensure accurate reporting golang-github-lusitaniae-apache_exporter: - Version update from 1.0.8 to 1.0.10: * Updated github.com/prometheus/client_golang to 1.21.1 * Updated github.com/prometheus/common to 0.63.0 * Updated github.com/prometheus/exporter-toolkit to 0.14.0 * Fixed signal handler logging golang-github-prometheus-prometheus: - Security issues fixed: * CVE-2026-27606: Fixed arbitrary file write via path traversal in rollup (bsc#1258893) * CVE-2026-25547: Fixed unbounded brace range expansion leading to excessive CPU and memory consumption (bsc#1257841) * CVE-2026-1615, CVE-2025-61140 The old web UI is no longer built due to security issues (bsc#1257897, bsc#1257442) * CVE-2025-13465: Bump lodash package to version 4.17.23 to fix prototype pollution vulnerability (bsc#1257329) * CVE-2025-12816: Interpretation conflict vulnerability allowing bypassing cryptographic verifications (bsc#1255588) - Version update from 2.53.4 to 3.5.0 with the following highlighted changes (jsc#PED-13824): * Modernized Interface: Introduced a brand-new UI * Enhanced Cloud and Auth: Added unified AWS service discovery (EC2, ECS, Lightsail) and Azure Workload Identity support for more secure, native cloudauthentication. * Performance Standards: Fully integrated OpenTelemetry (OTLP) ingestion and moved Native Histograms from experimental to a stable feature. * Advanced Data Export: Rolled out Remote Write 2.0, offering better performance and metadata handling when sending data to external systems. * Query Power: Added new PromQL functions (like first_over_time and last_over_time) and optimization for grouping operations * Better Visibility: The UI now displays detailed relabeling steps, scrape intervals, and timeouts, making it easier to troubleshoot why targets aren't reporting correctly. * Critical Fixes: Resolved significant memory leaks related to query logging and fixed bugs where targets were accidentally being scraped multiple times grafana: - Security issues fixed: * CVE-2026-21722: Public dashboards annotations: use dashboard timerange if time selection disabled (bsc#1258136) * CVE-2026-21721: Fixed access control by the dashboard permissions API (bsc#1257337) * CVE-2026-21720: Fixed unauthenticated DoS (bsc#1257349) * CVE-2025-68156: Fixed potential DoS via unbounded recursion in builtin functions (bsc#1255340) * CVE-2025-3415: Fixedexposure of DingDing alerting integration URL to Viewer level users (bsc#1245302) - Version update from 11.5.10 to 11.6.11 with the following highlighted changes and fixes: * Performance Boost: Introduced WebGL-powered geomaps for smoother map visualizations and removed blurred backgrounds from UI overlays to speed up the interface * One-Click Actions: Visualizations now support faster navigation via one-click links and actions * Alerting History: Added version history for alert rules, allowing you to track changes over time * Service Accounts: Automated the migration of old API keys to more secure Service Accounts upon startup * Cron Support: Annotations now support Cron syntax for more flexible scheduling * Identity and Auth: Hardened the Avatar feature (now requires sign-in) and fixed several login redirection issues when Grafana is hosted on a subpath * Data Source Support: Added support for Cloud Partner Prometheus data sources and improved Azure legend formatting * Alerting Limits: Added size limits for expanded notification templates to prevent system strain * RBAC: Integrated Role-Based Access Control (RBAC) into the Alertmanager via the reqAction field * Data Consistency: Fixed several issues with Graphite and InfluxDB regarding how variables are handled in repeated rows or nested queries * Dashboard Reliability: Resolved bugs involving row repeats and 'self-referencing' data links * Alerting Fixes: Patched a critical 'panic' (crash) caused by a race condition in alert rules and fixed issues where contact points weren't working correctly * URL Handling: Fixed a bug where 'true' values in URL parameters weren't being read correctly prometheus-blackbox_exporter: - Non-customer-facing optimization and update spacecmd: - Version update to 5.0.15: * Fixed typo in spacecmd help ca-cert flag (bsc#1253174) * Convert cached IDs to integer values (bsc#1251995) * Fixed spacecmd binary file upload (bsc#1253659) uyuni-tools: - Version update to 0.1.38: * Fixed cobbler configuration when migrating to standalone files (bsc#1256803) * Detect custom apache and squid config in the /etc/uyuni/proxy folder * Add ssh tuning to configure sshd (bsc#1253738) * Ignore supportconfig errors (bsc#1255781) * Bumped the default image tag to 5.0.7 * Removed cgroup mount for podman containers (bsc#1253347) * Registry flag can be a string (bsc#1254589) * Use static supportconfig name to avoid dynamic search (bsc#1257941)CVSSUnscored Insufficient evidenceSUSE-SU-2025:4458-1opensuse · dracut-saltboot&distro=openSUSE Leap 15.6 +11 more10mo agoopensuse dracut-saltboot&distro=openSUSE Leap 15.6Security update 5.0.6 for Multi-Linux Manager Client Tools This update fixes the following issues: dracut-saltboot: - Update to version 1.0.0 * Reboot on salt key timeout (bsc#1237495) * Fixed parsing files with space in the name (bsc#1252100) grafana was updated from version 11.5.5 to 11.5.10: - Security issues fixed: * CVE-2025-47911: Fix parsing HTML documents (bsc#1251454) * CVE-2025-58190: Fix excessive memory consumption (bsc#1251657) * CVE-2025-64751: Drop experimental implementation of authorization Zanzana server/client (bsc#1254113) * CVE-2025-11065: Fixed sensitive information leak in logs (version 11.5.9) (bsc#1250616) * CVE-2025-6023: Fixed cross-site-scripting via scripted dashboards (version 11.5.7) (bsc#1246735) * CVE-2025-6197: Fixed open redirect in organization switching (version 11.5.7) (bsc#1246736) * CVE-2025-3415: Fixed exposure of DingDing alerting integration URL to Viewer level users (version 11.5.6) (bsc#1245302) - Other changes, new features and bugs fixed: * Version 11.5.10: + Update to Go 1.25 + Update to golang.org/x/net v0.45.0 + Auth: Fix render user OAuth passthrough + LDAP Authentication: Fix URL to propagate username context as parameter * Version 11.5.9: + Auditing: Document new options for recording datasource query request/response body. + Login: Fixed redirection after login when Grafana is served from subpath. * Version 11.5.7: + Azure: Fixed legend formatting and resource name determination in template variable queries. mgr-push: - Version 5.0.3-0 * Fixed syntax error in changelog rhnlib: - Version 5.0.6-0 * Use more secure defusedxml parser (bsc#1227577) spacecmd: - Version 5.0.14-0 * Fixed installation of python lib files on Ubuntu 24.04 (bsc#1246586) * Use JSON instead of pickle for spacecmd cache (bsc#1227579) * Make spacecmd to work with Python 3.12 and higher * Call print statements properly in Python 3 uyuni-tools: - Version 0.1.37-0 * Handle CA files with symlinks during migration (bsc#1251044) * Add a lowercase version of --logLevel (bsc#1243611) * Adjust traefik exposed configuration for chart v27+ (bsc#1247721) * Stop executing scripts in temporary folder (bsc#1243704) * Convert the traefik install time to local time (bsc#1251138) * Run smdba and reindex only during migration (bsc#1244534) * Support config: collect podman inspect for hub container (bsc#1245099) * Add --registry-host, --registry-user and --registry-password to pull images from an authenticate registry * Deprecate --registry * Use new dedicated path for Cobbler settings (bsc#1244027) * Migrate custom auto installation snippets (bsc#1246320) * Add SLE15SP7 to buildin productmap * Fix loading product map from mgradm configuration file (bsc#1246068) * Fix channel override for distro copy * Do not use sudo when running as a root user (bsc#1246882) * Do not require backups to be at the same location for restoring (bsc#1246906) * Check for restorecon presence before calling (bsc#1246925) * Automatically get up-to-date systemid file on salt based proxy hosts (bsc#1246789) * Fix recomputing proxy images when installing a ptf or test (bsc#1246553) * Add migration for server monitoring configuration (bsc#1247688) - Version 0.1.36-0 * Bump the default image tag - Version 0.1.35-0 * Restore SELinux contexts for restored backup volumes (bsc#1244127) - Version 0.1.34-0 * Fix mgradm backup create handling of images and systemd files (bsc#1246738) - Version 0.1.33-0 * Restore volumes using tar instead of podman import (bsc#1244127)CVSSUnscored Insufficient evidenceSUSE-SU-2025:01989-1opensuse · prometheus-blackbox_exporter&distro=openSUSE Leap 15.6 +5 more1y agoopensuse prometheus-blackbox_exporter&distro=openSUSE Leap 15.6Security update for Multi-Linux Manager Client Tools This update fixes the following issues: golang-github-prometheus-prometheus was updated to version 2.53.4: - Security issues fixed: * CVE-2023-45288: Require Go >= 1.23 for building (bsc#1236516) * CVE-2025-22870: Bumped golang.org/x/net to version 0.39.0 (bsc#1238686) - Other bugs fixes from version 2.53.4: * Runtime: fixed GOGC being set to 0 when installed with empty prometheus.yml file resulting high cpu usage * Scrape: fixed dropping valid metrics after previous scrape failed prometheus-blackbox_exporter was updated from version 0.24.0 to 0.26.0 (jsc#PED-12872): - Security issues fixed: * CVE-2025-22870: Fixed proxy bypassing using IPv6 zone IDs (bsc#1238680) * CVE-2023-45288: Fixed closing connections when receiving too many headers (bsc#1236515) - Other changes from version 0.26.0: * Changes: + Replace go-kit/log with log/slog module. * Features: + Add metric to record tls ciphersuite negotiated during handshake. + Add a way to export labels with content matched by the probe. Reports Certificate Serial number. * Enhancement: + Add stale workflow to start sync with stale.yaml in Prometheus. * Bug fixes: + Only register grpc TLS metrics on successful handshake. - Other changes from version 0.25.0: * Features: + Allow to get Probe logs by target. + Log errors from probe. * Bug fixes: + Prevent logging confusing error message. + Explicit registration of internal exporter metrics. grafana was updated from version 10.4.15 to 11.5.5 (jsc#PED-12918): - Security issues fixed: * CVE-2025-4123: Fix cross-site scripting vulnerability (bsc#1243714). * CVE-2025-22872: Bump golang.org/x/net/html (bsc#1241809) * CVE-2025-3580: Prevent unauthorized server admin deletion (bsc#1243672). * CVE-2025-29923: Bump github.com/redis/go-redis/v9 to 9.6.3. * CVE-2025-3454: Sanitize paths before evaluating access to route (bsc#1241683). * CVE-2025-2703: Fix built-in XY Chart plugin (bsc#1241687). * CVE-2025-22870: Bump golang.org/x/net (bsc#1238703). * CVE-2024-9476: Fix Migration Assistant issue (bsc#1233343) * CVE-2024-9264: SQL Expressions (bsc#1231844) * CVE-2023-45288: Bump golang.org/x/net (bsc#1236510) * CVE-2025-22870: Bump golang.org/x/net to version 0.37.0 (bsc#1238686) - Potential breaking changes in version 11.5.0: * Loki: Default to /labels API with query param instead of /series API. - Potential breaking changes in version 11.0.1: * If you had selected your language as 'Portugu�s Brasileiro' previously, this will be reset. You have to select it again in your Preferences for the fix to be applied and the translations will then be shown. - Potential breaking changes in version 11.0.0: * AngularJS support is turned off by default. * Legacy alerting is entirely removed. * Subfolders cause very rare issues with folders which have slashes in their names. * The input data source is removed. * Data sources: Responses which are associated with hidden queries will be removed (filtered) by Grafana. * The URL which is generated when viewing an individual repeated panel has changed. * React Router is deprecated. * The grafana/e2e testing tool is deprecated. - This update brings many new features, enhancements and fixes highlighted at: * https://grafana.com/docs/grafana/next/whatsnew/whats-new-in-v11-5/ * https://grafana.com/docs/grafana/next/whatsnew/whats-new-in-v11-4/ * https://grafana.com/docs/grafana/next/whatsnew/whats-new-in-v11-3/ * https://grafana.com/docs/grafana/next/whatsnew/whats-new-in-v11-2/ * https://grafana.com/docs/grafana/next/whatsnew/whats-new-in-v11-1/ * https://grafana.com/docs/grafana/next/whatsnew/whats-new-in-v11-0/CVSSUnscored RoutineCVE-2025-27144go-jose +692 more1y agoGo JOSE's Parsing Vulnerable to Denial of ServiceGo JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web Token (JWT) standards. In versions on the 4.x branch prior to version 4.0.5, when parsing compact JWS or JWE input, Go JOSE could use excessive memory. The code used strings.Split(token, ".") to split JWT tokens, which is vulnerable to excessive memory consumption when processing maliciously crafted tokens with a large number of `.` characters. An attacker could exploit this by sending numerous malformed tokens, leading to memory exhaustion and a Denial of Service. Version 4.0.5 fixes this issue. As a workaround, applications could pre-validate that payloads passed to Go JOSE do not contain an excessive number of `.` characters.CVSS6.6MediumEPSS0.40%Insufficient evidenceSUSE-SU-2025:0624-1SUSE Linux Enterprisesuse · grafana&distro=SUSE Manager Client Tools 151y agosuse grafana&distro=SUSE Manager Client Tools 15Security update for grafana This update for grafana fixes the following issues: grafana was updated from version 10.4.13 to 10.4.15: - Security issues fixed: * CVE-2024-45339: Fixed vulnerability when creating log files (bsc#1236559) * CVE-2024-11741: Fixed the Grafana Alerting VictorOps integration (bsc#1236734) * CVE-2025-21613: Removed vulnerable library github.com/go-git/go-git/v5 (bsc#1235574) * CVE-2024-28180: Fixed improper handling of highly compressed data (bsc#1235206) - Other bugs fixed and changes: * Alerting: Do not fetch Orgs if the user is authenticated by apikey/sa or render key * Added provisioning directories * Use /bin/bash in wrapper scriptsCVSSUnscored