Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

x/vulndb: potential Go vuln in github.com/grafana/grafana: GHSA-vw7q-p2qg-4m5f #2857

Closed
GoVulnBot opened this issue May 15, 2024 · 2 comments
Closed

x/vulndb: potential Go vuln in github.com/grafana/grafana: GHSA-vw7q-p2qg-4m5f #2857

GoVulnBot opened this issue May 15, 2024 · 2 comments
Labels
triaged

Comments

@GoVulnBot
Copy link

In GitHub Security Advisory GHSA-vw7q-p2qg-4m5f, there is a vulnerability in the following Go packages or modules:

Unit Fixed Vulnerable Ranges
github.com/grafana/grafana 8.3.10 >= 8.0.0, < 8.3.10

Cross references:

See doc/triage.md for instructions on how to triage this report.

id: GO-ID-PENDING
modules:
    - module: github.com/grafana/grafana
      versions:
        - introduced: 8.0.0
          fixed: 8.3.10
        - introduced: 8.4.0
          fixed: 8.4.10
        - introduced: 8.5.0
          fixed: 8.5.9
        - introduced: 9.0.0
          fixed: 9.0.3
      packages:
        - package: github.com/grafana/grafana
summary: Grafana Stored Cross-site Scripting in Unified Alerting in github.com/grafana/grafana
cves:
    - CVE-2022-31097
ghsas:
    - GHSA-vw7q-p2qg-4m5f
references:
    - advisory: https://github.com/grafana/grafana/security/advisories/GHSA-vw7q-p2qg-4m5f
    - web: https://grafana.com/docs/grafana/latest/release-notes/release-notes-8-5-9
    - web: https://grafana.com/docs/grafana/latest/release-notes/release-notes-9-0-3
    - web: https://grafana.com/docs/grafana/next/release-notes/release-notes-8-4-10
    - web: https://security.netapp.com/advisory/ntap-20220901-0010
source:
    id: GHSA-vw7q-p2qg-4m5f
@gopherbot
Copy link
Contributor

Change https://go.dev/cl/590277 mentions this issue: data/reports: add 26 unreviewed reports

@gopherbot
Copy link
Contributor

Change https://go.dev/cl/606359 mentions this issue: data/reports: regenerate 50 reports

gopherbot pushed a commit that referenced this issue Aug 19, 2024
@tatianab @gopherbot
data/reports: regenerate 50 reports
4c06ac4 
  - data/reports/GO-2024-2642.yaml
  - data/reports/GO-2024-2644.yaml
  - data/reports/GO-2024-2645.yaml
  - data/reports/GO-2024-2664.yaml
  - data/reports/GO-2024-2665.yaml
  - data/reports/GO-2024-2675.yaml
  - data/reports/GO-2024-2684.yaml
  - data/reports/GO-2024-2690.yaml
  - data/reports/GO-2024-2697.yaml
  - data/reports/GO-2024-2704.yaml
  - data/reports/GO-2024-2707.yaml
  - data/reports/GO-2024-2718.yaml
  - data/reports/GO-2024-2719.yaml
  - data/reports/GO-2024-2728.yaml
  - data/reports/GO-2024-2741.yaml
  - data/reports/GO-2024-2752.yaml
  - data/reports/GO-2024-2757.yaml
  - data/reports/GO-2024-2769.yaml
  - data/reports/GO-2024-2792.yaml
  - data/reports/GO-2024-2801.yaml
  - data/reports/GO-2024-2815.yaml
  - data/reports/GO-2024-2843.yaml
  - data/reports/GO-2024-2844.yaml
  - data/reports/GO-2024-2847.yaml
  - data/reports/GO-2024-2848.yaml
  - data/reports/GO-2024-2851.yaml
  - data/reports/GO-2024-2852.yaml
  - data/reports/GO-2024-2854.yaml
  - data/reports/GO-2024-2855.yaml
  - data/reports/GO-2024-2856.yaml
  - data/reports/GO-2024-2857.yaml
  - data/reports/GO-2024-2858.yaml
  - data/reports/GO-2024-2866.yaml
  - data/reports/GO-2024-2867.yaml
  - data/reports/GO-2024-2877.yaml
  - data/reports/GO-2024-2886.yaml
  - data/reports/GO-2024-2891.yaml
  - data/reports/GO-2024-2898.yaml
  - data/reports/GO-2024-2901.yaml
  - data/reports/GO-2024-2902.yaml
  - data/reports/GO-2024-2905.yaml
  - data/reports/GO-2024-2911.yaml
  - data/reports/GO-2024-2917.yaml
  - data/reports/GO-2024-2919.yaml
  - data/reports/GO-2024-2922.yaml
  - data/reports/GO-2024-2939.yaml
  - data/reports/GO-2024-2941.yaml
  - data/reports/GO-2024-2972.yaml
  - data/reports/GO-2024-2981.yaml
  - data/reports/GO-2024-2987.yaml

Updates #2642
Updates #2644
Updates #2645
Updates #2664
Updates #2665
Updates #2675
Updates #2684
Updates #2690
Updates #2697
Updates #2704
Updates #2707
Updates #2718
Updates #2719
Updates #2728
Updates #2741
Updates #2752
Updates #2757
Updates #2769
Updates #2792
Updates #2801
Updates #2815
Updates #2843
Updates #2844
Updates #2847
Updates #2848
Updates #2851
Updates #2852
Updates #2854
Updates #2855
Updates #2856
Updates #2857
Updates #2858
Updates #2866
Updates #2867
Updates #2877
Updates #2886
Updates #2891
Updates #2898
Updates #2901
Updates #2902
Updates #2905
Updates #2911
Updates #2917
Updates #2919
Updates #2922
Updates #2939
Updates #2941
Updates #2972
Updates #2981
Updates #2987

Change-Id: I2dff127628eabc7c25afa4020c15a4d35a46a2c4
Reviewed-on: https://go-review.googlesource.com/c/vulndb/+/606359
LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
Auto-Submit: Tatiana Bradley <tatianabradley@google.com>
Reviewed-by: Damien Neil <dneil@google.com>
@GoVulnBot GoVulnBot mentioned this issue Aug 20, 2024
Closed
This was referenced Oct 25, 2024
Closed
Closed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
triaged
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
3 participants
@tatianab @gopherbot @GoVulnBot