Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.

Short description of the vulnerability: 

A signed-in user, including a user with the Viewer role, could crash Grafana by sending a deeply nested math expression. A user allowed to create alert rules could make the crash repeat on every restart. The fixed versions limit how deeply expressions can be nested. 

Known mitigations: 

There is no simple workaround. Disabling server-side expressions ([expressions] enabled = false) prevents the issue but also disables expression-based alerting. 

Affected products and versions: 

Grafana and Grafana Enterprise 12.4.0 to 12.4.13, 13.0.0 to 13.0.11, 13.1.0 to 13.1.8, and 13.2.0 to 13.2.4. Versions 7.4.0 to 12.3.11 are also affected; they are end of life and will not receive a fix. 

Affected platforms: 

Self-managed (on-premise)