Bug 1941024 (CVE-2021-27358)

Summary: CVE-2021-27358 grafana: snapshot feature allow an unauthenticated remote attacker to trigger a DoS via a remote API call
Product: [Other] Security Response Reporter: Guilherme de Almeida Suckevicz <gsuckevi>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED ERRATA QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: agerstmayr, alegrand, amctagga, anharris, anpicker, bmontgom, bniver, eparis, erooth, flucifre, gghezzo, gmeno, gparvin, grafana-maint, hvyas, jburrell, jkurik, jokerman, jramanat, jweiser, jwendell, kakkoyun, kconner, lcosic, mbenjamin, mgoodwin, mhackett, nathans, nstielau, pkrupa, rcernich, sostapov, sponnaga, stcannon, surbania, thee, twalsh, vereddy
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: grafana 7.4.2 Doc Type: If docs needed, set a value
Doc Text:
A flaw was found in Grafana. The snapshot feature allows unauthenticated remote attackers to trigger a denial of service (DoS) via a remote API call if anonymous access is enabled. The highest threat from this vulnerability is to system availability.
Story Points: ---
Clone Of: Environment:
Last Closed: 2021-08-06 01:07:14 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 1942111, 1942112, 1942113, 1941025, 1941077, 1941078, 1941079, 1941792, 1941793, 1942833, 1943431, 1943432, 1944155, 2039025    
Bug Blocks: 1941026    

Description Guilherme de Almeida Suckevicz 2021-03-19 18:31:02 UTC
The snapshot feature in Grafana before 7.4.1 can allow an unauthenticated remote attackers to trigger a Denial of Service via a remote API call if a commonly used configuration is set.

References:
https://github.com/grafana/grafana/blob/master/CHANGELOG.md#742-2021-02-17
https://grafana.com/docs/grafana/latest/release-notes/release-notes-7-4-2/

Comment 1 Guilherme de Almeida Suckevicz 2021-03-19 18:31:35 UTC
Created grafana tracking bugs for this issue:

Affects: fedora-all [bug 1941025]

Comment 12 Hardik Vyas 2021-03-29 12:29:00 UTC
Statement:

While in OpenShift Container Platform (OCP), OpenShift ServiceMesh (OSSM) and Red Hat Advanced Cluster Management for Kubernetes (RHACM) there is shipped a vulnerable version of grafana, access to the grafana panel is behind OpenShift OAuth proxy and requires admin permissions. Therefore these components are affected but with impact Low.

Red Hat Ceph Storage (RHCS) and Red Hat Gluster Storage 3 does not ship the directly affected code, however, they are still affected by this vulnerability because it allows the same configuration of anonymous snapshots, hence this issue has been rated as having a security impact of Low.

Comment 15 Sage McTaggart 2021-03-29 15:05:20 UTC
External References:

https://grafana.com/docs/grafana/latest/release-notes/release-notes-7-4-2/

Comment 18 errata-xmlrpc 2021-08-06 00:50:36 UTC
This issue has been addressed in the following products:

  Red Hat Advanced Cluster Management for Kubernetes 2.3 for RHEL 7
  Red Hat Advanced Cluster Management for Kubernetes 2.3 for RHEL 8

Via RHSA-2021:3016 https://access.redhat.com/errata/RHSA-2021:3016

Comment 19 Product Security DevOps Team 2021-08-06 01:07:14 UTC
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2021-27358

Comment 20 errata-xmlrpc 2021-11-09 17:49:01 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2021:4226 https://access.redhat.com/errata/RHSA-2021:4226