Package Instance
Lookup for vulnerable packages by Package URL.
GET /api/packages/97691?format=api
{ "url": "http://public2.vulnerablecode.io/api/packages/97691?format=api", "purl": "pkg:rpm/redhat/grafana@9.0.9-2?arch=el9", "type": "rpm", "namespace": "redhat", "name": "grafana", "version": "9.0.9-2", "qualifiers": { "arch": "el9" }, "subpath": "", "is_vulnerable": true, "next_non_vulnerable_version": null, "latest_non_vulnerable_version": null, "affected_by_vulnerabilities": [ { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/42101?format=api", "vulnerability_id": "VCID-1rsj-pm1p-qbd6", "summary": "Multiple vulnerabilities have been discovered in Go, the worst of which could lead to remote code execution.", "references": [ { "reference_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2022-2880.json", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N" } ], "url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2022-2880.json" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2022-2880", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00031", "scoring_system": "epss", "scoring_elements": "0.09016", "published_at": "2026-04-02T12:55:00Z" }, { "value": "0.00031", "scoring_system": "epss", "scoring_elements": "0.09067", "published_at": "2026-04-04T12:55:00Z" }, { "value": "0.00031", "scoring_system": "epss", "scoring_elements": "0.08991", "published_at": "2026-04-07T12:55:00Z" }, { "value": "0.00031", "scoring_system": "epss", "scoring_elements": "0.09071", "published_at": "2026-04-08T12:55:00Z" }, { "value": "0.00031", "scoring_system": "epss", "scoring_elements": "0.09102", "published_at": "2026-04-09T12:55:00Z" }, { "value": "0.00031", "scoring_system": "epss", "scoring_elements": "0.09103", "published_at": "2026-04-11T12:55:00Z" }, { "value": "0.00031", "scoring_system": "epss", "scoring_elements": "0.0907", "published_at": "2026-04-12T12:55:00Z" }, { "value": "0.00031", "scoring_system": "epss", "scoring_elements": "0.09056", "published_at": "2026-04-13T12:55:00Z" }, { "value": "0.00031", "scoring_system": "epss", "scoring_elements": "0.08951", "published_at": "2026-04-16T12:55:00Z" }, { "value": "0.00031", "scoring_system": "epss", "scoring_elements": "0.08932", "published_at": "2026-04-18T12:55:00Z" }, { "value": "0.00031", "scoring_system": "epss", "scoring_elements": "0.09084", "published_at": "2026-04-21T12:55:00Z" }, { "value": "0.00031", "scoring_system": "epss", "scoring_elements": "0.09128", "published_at": "2026-04-24T12:55:00Z" }, { "value": "0.00031", "scoring_system": "epss", "scoring_elements": "0.09076", "published_at": "2026-04-26T12:55:00Z" }, { "value": "0.00031", "scoring_system": "epss", "scoring_elements": "0.09045", "published_at": "2026-04-29T12:55:00Z" }, { "value": "0.00031", "scoring_system": "epss", "scoring_elements": "0.0896", "published_at": "2026-05-05T12:55:00Z" }, { "value": "0.00031", "scoring_system": "epss", "scoring_elements": "0.09123", "published_at": "2026-05-07T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2022-2880" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-2880", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-2880" }, { "reference_url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H" } ], "url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml" }, { "reference_url": "https://bugzilla.redhat.com/show_bug.cgi?id=2132868", "reference_id": "2132868", "reference_type": "", "scores": [], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2132868" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2022:7398", "reference_id": "RHSA-2022:7398", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2022:7398" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2022:7399", "reference_id": "RHSA-2022:7399", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2022:7399" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2022:8535", "reference_id": "RHSA-2022:8535", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2022:8535" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2022:8781", "reference_id": "RHSA-2022:8781", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2022:8781" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2023:0264", "reference_id": "RHSA-2023:0264", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2023:0264" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2023:0328", "reference_id": "RHSA-2023:0328", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2023:0328" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2023:0445", "reference_id": "RHSA-2023:0445", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2023:0445" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2023:0446", "reference_id": "RHSA-2023:0446", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2023:0446" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2023:0584", "reference_id": "RHSA-2023:0584", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2023:0584" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2023:0693", "reference_id": "RHSA-2023:0693", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2023:0693" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2023:0708", "reference_id": "RHSA-2023:0708", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2023:0708" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2023:0709", "reference_id": "RHSA-2023:0709", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2023:0709" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2023:0727", "reference_id": "RHSA-2023:0727", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2023:0727" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2023:1042", "reference_id": "RHSA-2023:1042", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2023:1042" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2023:1174", "reference_id": "RHSA-2023:1174", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2023:1174" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2023:1275", "reference_id": "RHSA-2023:1275", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2023:1275" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2023:2167", "reference_id": "RHSA-2023:2167", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2023:2167" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2023:2204", "reference_id": "RHSA-2023:2204", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2023:2204" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2023:2357", "reference_id": "RHSA-2023:2357", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2023:2357" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2023:2780", "reference_id": "RHSA-2023:2780", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2023:2780" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2023:2784", "reference_id": "RHSA-2023:2784", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2023:2784" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2023:2866", "reference_id": "RHSA-2023:2866", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2023:2866" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2023:3205", "reference_id": "RHSA-2023:3205", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2023:3205" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2023:3613", "reference_id": "RHSA-2023:3613", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2023:3613" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2023:3642", "reference_id": "RHSA-2023:3642", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2023:3642" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2023:3742", "reference_id": "RHSA-2023:3742", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2023:3742" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2023:4003", "reference_id": "RHSA-2023:4003", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2023:4003" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2024:0121", "reference_id": "RHSA-2024:0121", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2024:0121" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2024:2944", "reference_id": "RHSA-2024:2944", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2024:2944" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2024:2988", "reference_id": "RHSA-2024:2988", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2024:2988" }, { "reference_url": "https://usn.ubuntu.com/6038-1/", "reference_id": "USN-6038-1", "reference_type": "", "scores": [], "url": "https://usn.ubuntu.com/6038-1/" }, { "reference_url": "https://usn.ubuntu.com/6038-2/", "reference_id": "USN-6038-2", "reference_type": "", "scores": [], "url": "https://usn.ubuntu.com/6038-2/" } ], "fixed_packages": [], "aliases": [ "CVE-2022-2880" ], "risk_score": 3.4, "exploitability": "0.5", "weighted_severity": "6.8", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-1rsj-pm1p-qbd6" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/48340?format=api", "vulnerability_id": "VCID-azr4-u36f-pbew", "summary": "Multiple vulnerabilities have been discovered in Go, the worst of which could result in denial of service.", "references": [ { "reference_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2022-27664.json", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.5", "scoring_system": "cvssv3", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H" } ], "url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2022-27664.json" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2022-27664", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00101", "scoring_system": "epss", "scoring_elements": "0.27932", "published_at": "2026-04-02T12:55:00Z" }, { "value": "0.00133", "scoring_system": "epss", "scoring_elements": "0.32375", "published_at": "2026-05-05T12:55:00Z" }, { "value": "0.00133", "scoring_system": "epss", "scoring_elements": "0.32438", "published_at": "2026-05-07T12:55:00Z" }, { "value": "0.00133", "scoring_system": "epss", "scoring_elements": "0.32514", "published_at": "2026-04-29T12:55:00Z" }, { "value": "0.00133", "scoring_system": "epss", "scoring_elements": "0.32861", "published_at": "2026-04-07T12:55:00Z" }, { "value": "0.00133", "scoring_system": "epss", "scoring_elements": "0.33036", "published_at": "2026-04-04T12:55:00Z" }, { "value": "0.00137", "scoring_system": "epss", "scoring_elements": "0.335", "published_at": "2026-04-16T12:55:00Z" }, { "value": "0.00137", "scoring_system": "epss", "scoring_elements": "0.33488", "published_at": "2026-04-12T12:55:00Z" }, { "value": "0.00137", "scoring_system": "epss", "scoring_elements": "0.3353", "published_at": "2026-04-11T12:55:00Z" }, { "value": "0.00137", "scoring_system": "epss", "scoring_elements": "0.33536", "published_at": "2026-04-09T12:55:00Z" }, { "value": "0.00137", "scoring_system": "epss", "scoring_elements": "0.33503", "published_at": "2026-04-08T12:55:00Z" }, { "value": "0.00137", "scoring_system": "epss", "scoring_elements": "0.33464", "published_at": "2026-04-13T12:55:00Z" }, { "value": "0.00137", "scoring_system": "epss", "scoring_elements": "0.33261", "published_at": "2026-04-26T12:55:00Z" }, { "value": "0.00137", "scoring_system": "epss", "scoring_elements": "0.33281", "published_at": "2026-04-24T12:55:00Z" }, { "value": "0.00137", "scoring_system": "epss", "scoring_elements": "0.33442", "published_at": "2026-04-21T12:55:00Z" }, { "value": "0.00137", "scoring_system": "epss", "scoring_elements": "0.33475", "published_at": "2026-04-18T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2022-27664" }, { "reference_url": "https://cs.opensource.google/go/x/net", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://cs.opensource.google/go/x/net" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-27664", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-27664" }, { "reference_url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], "url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml" }, { "reference_url": "https://go.dev/cl/428735", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://go.dev/cl/428735" }, { "reference_url": "https://go.dev/issue/54658", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://go.dev/issue/54658" }, { "reference_url": "https://groups.google.com/g/golang-announce", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://groups.google.com/g/golang-announce" }, { "reference_url": "https://groups.google.com/g/golang-announce/c/x49AQzIVX-s", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://groups.google.com/g/golang-announce/c/x49AQzIVX-s" }, { "reference_url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JXKTHIGE5F576MAPFYCIJXNRGBSPISUF", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JXKTHIGE5F576MAPFYCIJXNRGBSPISUF" }, { "reference_url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TXS2OQ57KZC5XZKK5UW4SYKPVQAHIOJX", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TXS2OQ57KZC5XZKK5UW4SYKPVQAHIOJX" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2022-27664", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-27664" }, { "reference_url": "https://pkg.go.dev/vuln/GO-2022-0969", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://pkg.go.dev/vuln/GO-2022-0969" }, { "reference_url": "https://security.netapp.com/advisory/ntap-20220923-0004", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://security.netapp.com/advisory/ntap-20220923-0004" }, { "reference_url": "https://bugzilla.redhat.com/show_bug.cgi?id=2124669", "reference_id": "2124669", "reference_type": "", "scores": [], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2124669" }, { "reference_url": "https://security.gentoo.org/glsa/202209-26", "reference_id": "GLSA-202209-26", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://security.gentoo.org/glsa/202209-26" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2022:7129", "reference_id": "RHSA-2022:7129", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2022:7129" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2022:7398", "reference_id": "RHSA-2022:7398", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2022:7398" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2022:8535", "reference_id": "RHSA-2022:8535", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2022:8535" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2022:8626", "reference_id": "RHSA-2022:8626", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2022:8626" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2022:8634", "reference_id": "RHSA-2022:8634", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2022:8634" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2022:8781", "reference_id": "RHSA-2022:8781", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2022:8781" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2023:0264", "reference_id": "RHSA-2023:0264", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2023:0264" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2023:0328", "reference_id": "RHSA-2023:0328", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2023:0328" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2023:0446", "reference_id": "RHSA-2023:0446", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2023:0446" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2023:0584", "reference_id": "RHSA-2023:0584", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2023:0584" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2023:0693", "reference_id": "RHSA-2023:0693", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2023:0693" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2023:0708", "reference_id": "RHSA-2023:0708", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2023:0708" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2023:0709", "reference_id": "RHSA-2023:0709", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2023:0709" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2023:1042", "reference_id": "RHSA-2023:1042", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2023:1042" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2023:1275", "reference_id": "RHSA-2023:1275", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2023:1275" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2023:1529", "reference_id": "RHSA-2023:1529", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2023:1529" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2023:2167", "reference_id": "RHSA-2023:2167", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2023:2167" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2023:2177", "reference_id": "RHSA-2023:2177", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2023:2177" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2023:2193", "reference_id": "RHSA-2023:2193", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2023:2193" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2023:2204", "reference_id": "RHSA-2023:2204", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2023:2204" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2023:2236", "reference_id": "RHSA-2023:2236", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2023:2236" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2023:2357", "reference_id": "RHSA-2023:2357", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2023:2357" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2023:2758", "reference_id": "RHSA-2023:2758", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2023:2758" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2023:2780", "reference_id": "RHSA-2023:2780", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2023:2780" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2023:2784", "reference_id": "RHSA-2023:2784", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2023:2784" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2023:2785", "reference_id": "RHSA-2023:2785", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2023:2785" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2023:2802", "reference_id": "RHSA-2023:2802", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2023:2802" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2023:3204", "reference_id": "RHSA-2023:3204", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2023:3204" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2023:3205", "reference_id": "RHSA-2023:3205", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2023:3205" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2023:3613", "reference_id": "RHSA-2023:3613", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2023:3613" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2023:3642", "reference_id": "RHSA-2023:3642", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2023:3642" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2023:3742", "reference_id": "RHSA-2023:3742", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2023:3742" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2023:4674", "reference_id": "RHSA-2023:4674", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2023:4674" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2023:4734", "reference_id": "RHSA-2023:4734", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2023:4734" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2023:5009", "reference_id": "RHSA-2023:5009", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2023:5009" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2024:0121", "reference_id": "RHSA-2024:0121", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2024:0121" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2024:2944", "reference_id": "RHSA-2024:2944", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2024:2944" }, { "reference_url": "https://usn.ubuntu.com/6038-1/", "reference_id": "USN-6038-1", "reference_type": "", "scores": [], "url": "https://usn.ubuntu.com/6038-1/" }, { "reference_url": "https://usn.ubuntu.com/6038-2/", "reference_id": "USN-6038-2", "reference_type": "", "scores": [], "url": "https://usn.ubuntu.com/6038-2/" }, { "reference_url": "https://usn.ubuntu.com/8089-1/", "reference_id": "USN-8089-1", "reference_type": "", "scores": [], "url": "https://usn.ubuntu.com/8089-1/" }, { "reference_url": "https://usn.ubuntu.com/8089-2/", "reference_id": "USN-8089-2", "reference_type": "", "scores": [], "url": "https://usn.ubuntu.com/8089-2/" }, { "reference_url": "https://usn.ubuntu.com/8089-3/", "reference_id": "USN-8089-3", "reference_type": "", "scores": [], "url": "https://usn.ubuntu.com/8089-3/" } ], "fixed_packages": [], "aliases": [ "CVE-2022-27664", "GHSA-69cg-p879-7622" ], "risk_score": 4.0, "exploitability": "0.5", "weighted_severity": "8.0", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-azr4-u36f-pbew" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/19151?format=api", "vulnerability_id": "VCID-fb5p-kja2-6fbb", "summary": "Grafana when using email as a username can block other users from signing in\nToday we are releasing Grafana 9.2. Alongside with new features and other bug fixes, this release includes a Moderate severity security fix for CVE-2022-39229 \n\nWe are also releasing security patches for Grafana 9.1.8 and Grafana 8.5.14 to fix these issues.\n\nRelease 9.2, latest release, also containing security fix:\n\n- [Download Grafana 9.2](https://grafana.com/grafana/download/9.2)\n\nRelease 9.1.8, only containing security fix:\n\n- [Download Grafana 9.1.8](https://grafana.com/grafana/download/9.1.8)\n\nRelease 8.5.14, only containing security fix:\n\n- [Download Grafana 8.5.14](https://grafana.com/grafana/download/8.5.14)\n\nAppropriate patches have been applied to [Grafana Cloud](https://grafana.com/cloud) and as always, we closely coordinated with all cloud providers licensed to offer Grafana Pro. They have received early notification under embargo and confirmed that their offerings are secure at the time of this announcement. This is applicable to Amazon Managed Grafana and Azure's Grafana as a service offering.\n\n## Improper authentication - CVE-2022-39229\n\n### Summary \n\nOn September 7 as a result of an internal security audit we have discovered a security vulnerability in Grafana basic authentication, related to the usage of username and email address. \n\nIn Grafana, a user’s username and email address are unique fields, that means no other user can have the same username or email address as another user. \n\nIn addition, a user can have an email address as a username and Grafana login allows users to sign in with either username or email address. This creates an unusual behavior, where _user_1_ can register with one email address and _user_2_ can register their username as _user_1_’s email address. As a result, _user_1_ would be prevented to sign in Grafana, since _user_1_ password won’t match with _users_2_ email address.\n\nThe CVSS score for this vulnerability is 4.3 Moderate (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L).\n\n### Impacted versions\n\nAll installations for Grafana versions <=9.x, <=8.x\n\n### Solutions and mitigations\n\nTo fully address CVE-2022-39229 please upgrade your Grafana instances. \nAppropriate patches have been applied to [Grafana Cloud](https://grafana.com/cloud).\n\n## Reporting security issues\n\nIf you think you have found a security vulnerability, please send a report to security@grafana.com. This address can be used for all of Grafana Labs' open source and commercial products (including, but not limited to Grafana, Grafana Cloud, Grafana Enterprise, and grafana.com) We can accept only vulnerability reports at this address. We would prefer that you encrypt your message to us by using our PGP key. The key fingerprint is\n\nF988 7BEA 027A 049F AE8E 5CAA D125 8932 BE24 C5CA\n\nThe key is available from keyserver.ubuntu.com.\n\n## Security announcements\n\nWe maintain a [security category](https://community.grafana.com/c/support/security-announcements) on our blog, where we will always post a summary, remediation, and mitigation details for any patch containing security fixes.\n\nYou can also subscribe to our [RSS feed](https://grafana.com/tags/security/index.xml).", "references": [ { "reference_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2022-39229.json", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.3", "scoring_system": "cvssv3", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L" } ], "url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2022-39229.json" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2022-39229", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00053", "scoring_system": "epss", "scoring_elements": "0.16908", "published_at": "2026-04-04T12:55:00Z" }, { "value": "0.00053", "scoring_system": "epss", "scoring_elements": "0.16851", "published_at": "2026-04-02T12:55:00Z" }, { "value": "0.00053", "scoring_system": "epss", "scoring_elements": "0.16692", "published_at": "2026-04-07T12:55:00Z" }, { "value": "0.00056", "scoring_system": "epss", "scoring_elements": "0.17427", "published_at": "2026-04-29T12:55:00Z" }, { "value": "0.00056", "scoring_system": "epss", "scoring_elements": "0.17518", "published_at": "2026-04-24T12:55:00Z" }, { "value": "0.00056", "scoring_system": "epss", "scoring_elements": "0.17607", "published_at": "2026-04-21T12:55:00Z" }, { "value": "0.00056", "scoring_system": "epss", "scoring_elements": "0.17573", "published_at": "2026-04-18T12:55:00Z" }, { "value": "0.00056", "scoring_system": "epss", "scoring_elements": "0.17565", "published_at": "2026-04-16T12:55:00Z" }, { "value": "0.00056", "scoring_system": "epss", "scoring_elements": "0.1762", "published_at": "2026-04-13T12:55:00Z" }, { "value": "0.00056", "scoring_system": "epss", "scoring_elements": "0.17636", "published_at": "2026-04-08T12:55:00Z" }, { "value": "0.00056", "scoring_system": "epss", "scoring_elements": "0.1729", "published_at": "2026-05-05T12:55:00Z" }, { "value": "0.00056", "scoring_system": "epss", "scoring_elements": "0.17495", "published_at": "2026-04-26T12:55:00Z" }, { "value": "0.00056", "scoring_system": "epss", "scoring_elements": "0.17671", "published_at": "2026-04-12T12:55:00Z" }, { "value": "0.00056", "scoring_system": "epss", "scoring_elements": "0.17716", "published_at": "2026-04-11T12:55:00Z" }, { "value": "0.00056", "scoring_system": "epss", "scoring_elements": "0.17698", "published_at": "2026-04-09T12:55:00Z" }, { "value": "0.00056", "scoring_system": "epss", "scoring_elements": "0.17381", "published_at": "2026-05-07T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2022-39229" }, { "reference_url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "3.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L" } ], "url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml" }, { "reference_url": "https://github.com/grafana/grafana", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L" }, { "value": "5.1", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/grafana/grafana" }, { "reference_url": "https://github.com/grafana/grafana/commit/5644758f0c5ae9955a4e5480d71f9bef57fdce35", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L" }, { "value": "5.1", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-04-23T13:56:25Z/" } ], "url": "https://github.com/grafana/grafana/commit/5644758f0c5ae9955a4e5480d71f9bef57fdce35" }, { "reference_url": "https://github.com/grafana/grafana/releases/tag/v9.1.8", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L" }, { "value": "5.1", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-04-23T13:56:25Z/" } ], "url": "https://github.com/grafana/grafana/releases/tag/v9.1.8" }, { "reference_url": "https://github.com/grafana/grafana/security/advisories/GHSA-gj7m-853r-289r", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L" }, { "value": "5.1", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-04-23T13:56:25Z/" } ], "url": "https://github.com/grafana/grafana/security/advisories/GHSA-gj7m-853r-289r" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2022-39229", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L" }, { "value": "5.1", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-39229" }, { "reference_url": "https://bugzilla.redhat.com/show_bug.cgi?id=2131149", "reference_id": "2131149", "reference_type": "", "scores": [], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2131149" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2023:2167", "reference_id": "RHSA-2023:2167", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2023:2167" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2023:2784", "reference_id": "RHSA-2023:2784", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2023:2784" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2023:3642", "reference_id": "RHSA-2023:3642", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2023:3642" } ], "fixed_packages": [], "aliases": [ "CVE-2022-39229", "GHSA-gj7m-853r-289r" ], "risk_score": 3.1, "exploitability": "0.5", "weighted_severity": "6.2", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-fb5p-kja2-6fbb" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/42102?format=api", "vulnerability_id": "VCID-rtb8-bayb-dfbn", "summary": "Multiple vulnerabilities have been discovered in Go, the worst of which could lead to remote code execution.", "references": [ { "reference_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2022-41715.json", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.5", "scoring_system": "cvssv3", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H" } ], "url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2022-41715.json" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2022-41715", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00016", "scoring_system": "epss", "scoring_elements": "0.03813", "published_at": "2026-04-02T12:55:00Z" }, { "value": "0.00016", "scoring_system": "epss", "scoring_elements": "0.03826", "published_at": "2026-04-04T12:55:00Z" }, { "value": "0.00016", "scoring_system": "epss", "scoring_elements": "0.03841", "published_at": "2026-04-07T12:55:00Z" }, { "value": "0.00016", "scoring_system": "epss", "scoring_elements": "0.03846", "published_at": "2026-04-08T12:55:00Z" }, { "value": "0.00016", "scoring_system": "epss", "scoring_elements": "0.0387", "published_at": "2026-04-09T12:55:00Z" }, { "value": "0.00016", "scoring_system": "epss", "scoring_elements": "0.03833", "published_at": "2026-04-11T12:55:00Z" }, { "value": "0.00016", "scoring_system": "epss", "scoring_elements": "0.03814", "published_at": "2026-04-12T12:55:00Z" }, { "value": "0.00016", "scoring_system": "epss", "scoring_elements": "0.03787", "published_at": "2026-04-13T12:55:00Z" }, { "value": "0.00016", "scoring_system": "epss", "scoring_elements": "0.03767", "published_at": "2026-04-16T12:55:00Z" }, { "value": "0.00016", "scoring_system": "epss", "scoring_elements": "0.03778", "published_at": "2026-04-18T12:55:00Z" }, { "value": "0.00016", "scoring_system": "epss", "scoring_elements": "0.03901", "published_at": "2026-04-21T12:55:00Z" }, { "value": "0.00016", "scoring_system": "epss", "scoring_elements": "0.03912", "published_at": "2026-04-24T12:55:00Z" }, { "value": "0.00016", "scoring_system": "epss", "scoring_elements": "0.03916", "published_at": "2026-04-26T12:55:00Z" }, { "value": "0.00016", "scoring_system": "epss", "scoring_elements": "0.03962", "published_at": "2026-04-29T12:55:00Z" }, { "value": "0.00016", "scoring_system": "epss", "scoring_elements": "0.03915", "published_at": "2026-05-05T12:55:00Z" }, { "value": "0.00016", "scoring_system": "epss", "scoring_elements": "0.03931", "published_at": "2026-05-07T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2022-41715" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-41715", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-41715" }, { "reference_url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.2", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], "url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml" }, { "reference_url": "https://bugzilla.redhat.com/show_bug.cgi?id=2132872", "reference_id": "2132872", "reference_type": "", "scores": [], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2132872" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2022:7398", "reference_id": "RHSA-2022:7398", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2022:7398" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2022:7399", "reference_id": "RHSA-2022:7399", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2022:7399" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2022:8535", "reference_id": "RHSA-2022:8535", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2022:8535" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2022:8781", "reference_id": "RHSA-2022:8781", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2022:8781" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2023:0264", "reference_id": "RHSA-2023:0264", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2023:0264" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2023:0328", "reference_id": "RHSA-2023:0328", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2023:0328" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2023:0445", "reference_id": "RHSA-2023:0445", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2023:0445" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2023:0446", "reference_id": "RHSA-2023:0446", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2023:0446" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2023:0584", "reference_id": "RHSA-2023:0584", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2023:0584" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2023:0693", "reference_id": "RHSA-2023:0693", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2023:0693" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2023:0708", "reference_id": "RHSA-2023:0708", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2023:0708" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2023:0709", "reference_id": "RHSA-2023:0709", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2023:0709" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2023:0727", "reference_id": "RHSA-2023:0727", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2023:0727" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2023:1042", "reference_id": "RHSA-2023:1042", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2023:1042" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2023:1079", "reference_id": "RHSA-2023:1079", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2023:1079" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2023:1174", "reference_id": "RHSA-2023:1174", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2023:1174" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2023:1275", "reference_id": "RHSA-2023:1275", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2023:1275" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2023:1529", "reference_id": "RHSA-2023:1529", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2023:1529" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2023:2167", "reference_id": "RHSA-2023:2167", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2023:2167" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2023:2204", "reference_id": "RHSA-2023:2204", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2023:2204" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2023:2357", "reference_id": "RHSA-2023:2357", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2023:2357" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2023:2592", "reference_id": "RHSA-2023:2592", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2023:2592" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2023:2780", "reference_id": "RHSA-2023:2780", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2023:2780" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2023:2784", "reference_id": "RHSA-2023:2784", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2023:2784" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2023:2866", "reference_id": "RHSA-2023:2866", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2023:2866" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2023:3205", "reference_id": "RHSA-2023:3205", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2023:3205" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2023:3613", "reference_id": "RHSA-2023:3613", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2023:3613" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2023:3642", "reference_id": "RHSA-2023:3642", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2023:3642" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2023:3742", "reference_id": "RHSA-2023:3742", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2023:3742" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2023:4003", "reference_id": "RHSA-2023:4003", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2023:4003" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2024:0121", "reference_id": "RHSA-2024:0121", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2024:0121" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2024:2586", "reference_id": "RHSA-2024:2586", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2024:2586" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2024:2944", "reference_id": "RHSA-2024:2944", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2024:2944" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2024:2988", "reference_id": "RHSA-2024:2988", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2024:2988" }, { "reference_url": "https://usn.ubuntu.com/6038-1/", "reference_id": "USN-6038-1", "reference_type": "", "scores": [], "url": "https://usn.ubuntu.com/6038-1/" } ], "fixed_packages": [], "aliases": [ "CVE-2022-41715" ], "risk_score": 3.0, "exploitability": "0.5", "weighted_severity": "5.9", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-rtb8-bayb-dfbn" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/18998?format=api", "vulnerability_id": "VCID-wkvy-hjee-nyh8", "summary": "Grafana Escalation from admin to server admin when auth proxy is used\nToday we are releasing Grafana 9.1.6, 9.0.9, 8.5.13. This patch release includes a Moderate severity security fix for CVE-2022-35957 that affects Grafana instances which are using Grafana [Auth Proxy](https://grafana.com/docs/grafana/latest/setup-grafana/configure-security/configure-authentication/auth-proxy/#configure-auth-proxy-authentication).\n\nRelease 9.1.6, latest patch, also containing security fix:\n\n- [Download Grafana 9.1.6](https://grafana.com/grafana/download/9.1.6)\n- [Release notes](https://grafana.com/docs/grafana/latest/release-notes/release-notes-9-1-6/)\n\nRelease 9.0.9, only containing security fix:\n\n- [Download Grafana 9.0.9](https://grafana.com/grafana/download/9.0.9)\n- [Release notes](https://grafana.com/docs/grafana/latest/release-notes/release-notes-9-0-9/)\n\nRelease 8.5.13, only containing security fix:\n\n- [Download Grafana 8.5.13](https://grafana.com/grafana/download/8.5.13)\n- [Release notes](https://grafana.com/docs/grafana/latest/release-notes/release-notes-8-5-13/)\n\nAppropriate patches have been applied to [Grafana Cloud](https://grafana.com/cloud) and as always, we closely coordinated with all cloud providers licensed to offer Grafana Pro. They have received early notification under embargo and confirmed that their offerings are secure at the time of this announcement. This is applicable to Amazon Managed Grafana and Azure's Grafana as a service offering.\n\n## Privilege escalation (CVE-2022-35957)\n\n### Summary \n\nOn August 9 an internal security review identified a vulnerability in the Grafana which allows an escalation from Admin privileges to Server Admin when Auth proxy authentication is used.\n\n[Auth proxy](https://grafana.com/docs/grafana/latest/setup-grafana/configure-security/configure-authentication/auth-proxy/#configure-auth-proxy-authentication) allows to authenticate a user by only providing the username (or email) in a `X-WEBAUTH-USER` HTTP header: the trust assumption is that a front proxy will take care of authentication and that Grafana server is publicly reachable only with this front proxy.\n\n[Datasource proxy](https://grafana.com/docs/grafana/latest/developers/http_api/data_source/#data-source-proxy-calls) breaks this assumption:\n- it is possible to configure a fake datasource pointing to a localhost Grafana install with a `X-WEBAUTH-USER` HTTP header containing admin username.\n- This fake datasource can be called publicly via this proxying feature.\n\nThe CVSS score for this vulnerability is 6.6 Moderate (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H).\n\n### Impacted versions\n\nAll Grafana installations where the [Auth Proxy](https://grafana.com/docs/grafana/latest/setup-grafana/configure-security/configure-authentication/auth-proxy/#configure-auth-proxy-authentication) is used.\n\n### Solutions and mitigations\n\nTo fully address CVE-2022-35957 please upgrade your Grafana instances. They are only required if you are using Auth proxy. If you can’t upgrade, as an alternative, you can deactivate the auth proxy. \n\nAppropriate patches have been applied to [Grafana Cloud](https://grafana.com/cloud).\n\n### Timeline\n\nHere is a timeline starting from when we originally learned of the issue. \n\n* 2022-08-09: Vulnerability is reported as a result of an Internal security audit.\n* 2022-08-09: Release timeline determined: 2022-09-06 for private customer release, 2022-09-20 for public release.\n* 2022-08-09: Confirmed that Grafana Cloud is not impacted.\n* 2022-09-06: Private release.\n* 2022-09-20: Public release.\n\n## Reporting security issues\n\nIf you think you have found a security vulnerability, please send a report to security@grafana.com. This address can be used for all of Grafana Labs' open source and commercial products (including, but not limited to Grafana, Grafana Cloud, Grafana Enterprise, and grafana.com) We can accept only vulnerability reports at this address. We would prefer that you encrypt your message to us by using our PGP key. The key fingerprint is\n\nF988 7BEA 027A 049F AE8E 5CAA D125 8932 BE24 C5CA\n\nThe key is available from keyserver.ubuntu.com.\n\n## Security announcements\n\nWe maintain a [security category](https://community.grafana.com/c/support/security-announcements) on our blog, where we will always post a summary, remediation, and mitigation details for any patch containing security fixes.\n\nYou can also subscribe to our [RSS feed](https://grafana.com/tags/security/index.xml).", "references": [ { "reference_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2022-35957.json", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.6", "scoring_system": "cvssv3", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H" } ], "url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2022-35957.json" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2022-35957", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00872", "scoring_system": "epss", "scoring_elements": "0.75215", "published_at": "2026-04-04T12:55:00Z" }, { "value": "0.00872", "scoring_system": "epss", "scoring_elements": "0.75312", "published_at": "2026-04-29T12:55:00Z" }, { "value": "0.00872", "scoring_system": "epss", "scoring_elements": "0.75308", "published_at": "2026-04-26T12:55:00Z" }, { "value": "0.00872", "scoring_system": "epss", "scoring_elements": "0.75304", "published_at": "2026-04-24T12:55:00Z" }, { "value": "0.00872", "scoring_system": "epss", "scoring_elements": "0.75269", "published_at": "2026-04-21T12:55:00Z" }, { "value": "0.00872", "scoring_system": "epss", "scoring_elements": "0.75184", "published_at": "2026-04-02T12:55:00Z" }, { "value": "0.00872", "scoring_system": "epss", "scoring_elements": "0.75192", "published_at": "2026-04-07T12:55:00Z" }, { "value": "0.00881", "scoring_system": "epss", "scoring_elements": "0.75374", "published_at": "2026-04-08T12:55:00Z" }, { "value": "0.00881", "scoring_system": "epss", "scoring_elements": "0.75418", "published_at": "2026-04-18T12:55:00Z" }, { "value": "0.00881", "scoring_system": "epss", "scoring_elements": "0.75412", "published_at": "2026-04-16T12:55:00Z" }, { "value": "0.00881", "scoring_system": "epss", "scoring_elements": "0.7537", "published_at": "2026-04-13T12:55:00Z" }, { "value": "0.00881", "scoring_system": "epss", "scoring_elements": "0.75382", "published_at": "2026-04-12T12:55:00Z" }, { "value": "0.00881", "scoring_system": "epss", "scoring_elements": "0.75404", "published_at": "2026-04-11T12:55:00Z" }, { "value": "0.00881", "scoring_system": "epss", "scoring_elements": "0.75459", "published_at": "2026-05-05T12:55:00Z" }, { "value": "0.00881", "scoring_system": "epss", "scoring_elements": "0.75384", "published_at": "2026-04-09T12:55:00Z" }, { "value": "0.00881", "scoring_system": "epss", "scoring_elements": "0.75489", "published_at": "2026-05-07T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2022-35957" }, { "reference_url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.6", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H" } ], "url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml" }, { "reference_url": "https://github.com/grafana/grafana", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.6", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H" }, { "value": "7.5", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/grafana/grafana" }, { "reference_url": "https://github.com/grafana/grafana/security/advisories/GHSA-ff5c-938w-8c9q", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.6", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H" }, { "value": "7.5", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2025-04-23T15:48:59Z/" } ], "url": "https://github.com/grafana/grafana/security/advisories/GHSA-ff5c-938w-8c9q" }, { "reference_url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WYU5C2RITLHVZSTCWNGQWA6KSPYNXM2H", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.6", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H" }, { "value": "7.5", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WYU5C2RITLHVZSTCWNGQWA6KSPYNXM2H" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2022-35957", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.6", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H" }, { "value": "7.5", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-35957" }, { "reference_url": "https://security.netapp.com/advisory/ntap-20221215-0001", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.6", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H" }, { "value": "7.5", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://security.netapp.com/advisory/ntap-20221215-0001" }, { "reference_url": "https://bugzilla.redhat.com/show_bug.cgi?id=2125514", "reference_id": "2125514", "reference_type": "", "scores": [], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2125514" }, { "reference_url": "https://security.netapp.com/advisory/ntap-20221215-0001/", "reference_id": "ntap-20221215-0001", "reference_type": "", "scores": [ { "value": "6.6", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2025-04-23T15:48:59Z/" } ], "url": "https://security.netapp.com/advisory/ntap-20221215-0001/" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2023:2167", "reference_id": "RHSA-2023:2167", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2023:2167" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2023:3642", "reference_id": "RHSA-2023:3642", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2023:3642" }, { "reference_url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WYU5C2RITLHVZSTCWNGQWA6KSPYNXM2H/", "reference_id": "WYU5C2RITLHVZSTCWNGQWA6KSPYNXM2H", "reference_type": "", "scores": [ { "value": "6.6", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2025-04-23T15:48:59Z/" } ], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WYU5C2RITLHVZSTCWNGQWA6KSPYNXM2H/" } ], "fixed_packages": [], "aliases": [ "CVE-2022-35957", "GHSA-ff5c-938w-8c9q" ], "risk_score": 4.0, "exploitability": "0.5", "weighted_severity": "8.0", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-wkvy-hjee-nyh8" } ], "fixing_vulnerabilities": [], "risk_score": "4.0", "resource_url": "http://public2.vulnerablecode.io/packages/pkg:rpm/redhat/grafana@9.0.9-2%3Farch=el9" }