SUSE-SU-2025:01991-1: moderate: Security update for grafana
SLE-SECURITY-UPDATES
null at suse.de
Wed Jun 18 08:30:22 UTC 2025
# Security update for grafana
Announcement ID: SUSE-SU-2025:01991-1
Release Date: 2025-06-18T02:12:31Z
Rating: moderate
References:
* bsc#1231844
* bsc#1233343
* bsc#1236510
* bsc#1236516
* bsc#1238686
* bsc#1238703
* bsc#1241683
* bsc#1241687
* bsc#1241809
* bsc#1243672
* bsc#1243714
* jsc#MSQA-992
* jsc#PED-12918
Cross-References:
* CVE-2023-45288
* CVE-2024-9264
* CVE-2024-9476
* CVE-2025-22870
* CVE-2025-22872
* CVE-2025-2703
* CVE-2025-29923
* CVE-2025-3454
CVSS scores:
* CVE-2023-45288 ( SUSE ): 6.9
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
* CVE-2023-45288 ( SUSE ): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
* CVE-2024-9264 ( SUSE ): 9.4
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
* CVE-2024-9264 ( SUSE ): 9.9 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
* CVE-2024-9264 ( NVD ): 9.4
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
* CVE-2024-9264 ( NVD ): 9.9 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
* CVE-2024-9264 ( NVD ): 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
* CVE-2024-9476 ( SUSE ): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
* CVE-2024-9476 ( NVD ): 5.1
CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
* CVE-2024-9476 ( NVD ): 0.0 CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:N/I:N/A:N
* CVE-2025-22870 ( SUSE ): 4.8
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N
* CVE-2025-22870 ( SUSE ): 4.4 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L
* CVE-2025-22870 ( NVD ): 4.4 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L
* CVE-2025-22872 ( SUSE ): 6.3
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L
* CVE-2025-22872 ( SUSE ): 6.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L
* CVE-2025-22872 ( NVD ): 6.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L
* CVE-2025-2703 ( SUSE ): 6.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
* CVE-2025-2703 ( NVD ): 6.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:L
* CVE-2025-29923 ( SUSE ): 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
* CVE-2025-29923 ( NVD ): 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
* CVE-2025-3454 ( SUSE ): 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
* CVE-2025-3454 ( NVD ): 5.0 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N
Affected Products:
* openSUSE Leap 15.6
* SUSE Linux Enterprise Desktop 15 SP6
* SUSE Linux Enterprise Desktop 15 SP7
* SUSE Linux Enterprise Real Time 15 SP6
* SUSE Linux Enterprise Real Time 15 SP7
* SUSE Linux Enterprise Server 15 SP6
* SUSE Linux Enterprise Server 15 SP7
* SUSE Linux Enterprise Server for SAP Applications 15 SP6
* SUSE Linux Enterprise Server for SAP Applications 15 SP7
* SUSE Package Hub 15 15-SP6
* SUSE Package Hub 15 15-SP7
An update that solves eight vulnerabilities, contains two features and has three
security fixes can now be installed.
## Description:
This update for grafana fixes the following issues:
grafana was updated from version 10.4.15 to 11.5.5 (jsc#PED-12918):
* Security issues fixed:
* CVE-2025-4123: Fix cross-site scripting vulnerability (bsc#1243714).
* CVE-2025-22872: Bump golang.org/x/net/html (bsc#1241809)
* CVE-2025-3580: Prevent unauthorized server admin deletion (bsc#1243672).
* CVE-2025-29923: Bump github.com/redis/go-redis/v9 to 9.6.3.
* CVE-2025-3454: Sanitize paths before evaluating access to route (bsc#1241683).
* CVE-2025-2703: Fix built-in XY Chart plugin (bsc#1241687).
* CVE-2025-22870: Bump golang.org/x/net (bsc#1238703).
* CVE-2024-9476: Fix Migration Assistant issue (bsc#1233343)
* CVE-2024-9264: SQL Expressions (bsc#1231844)
* CVE-2023-45288: Bump golang.org/x/net (bsc#1236510)
* CVE-2025-22870: Bump golang.org/x/net to version 0.37.0 (bsc#1238686)
* Potential breaking changes in version 11.5.0:
* Loki: Default to /labels API with query param instead of /series API.
* Potential breaking changes in version 11.0.1:
* If you had selected your language as "Português Brasileiro" previously, this will be reset. You have to select it again in your Preferences for the fix to be applied and the translations will then be shown.
* Potential breaking changes in version 11.0.0:
* AngularJS support is turned off by default.
* Legacy alerting is entirely removed.
* Subfolders cause very rare issues with folders which have slashes in their names.
* The input data source is removed.
* Data sources: Responses which are associated with hidden queries will be removed (filtered) by Grafana.
* The URL which is generated when viewing an individual repeated panel has changed.
* React Router is deprecated.
* The grafana/e2e testing tool is deprecated.
* This update brings many new features, enhancements and fixes highlighted at:
* https://grafana.com/docs/grafana/next/whatsnew/whats-new-in-v11-5/
* https://grafana.com/docs/grafana/next/whatsnew/whats-new-in-v11-4/
* https://grafana.com/docs/grafana/next/whatsnew/whats-new-in-v11-3/
* https://grafana.com/docs/grafana/next/whatsnew/whats-new-in-v11-2/
* https://grafana.com/docs/grafana/next/whatsnew/whats-new-in-v11-1/
* https://grafana.com/docs/grafana/next/whatsnew/whats-new-in-v11-0/
## Patch Instructions:
To install this SUSE update use the SUSE recommended installation methods like
YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:
* SUSE Package Hub 15 15-SP7
zypper in -t patch SUSE-SLE-Module-Packagehub-Subpackages-15-SP7-2025-1991=1
* openSUSE Leap 15.6
zypper in -t patch openSUSE-SLE-15.6-2025-1991=1
* SUSE Package Hub 15 15-SP6
zypper in -t patch SUSE-SLE-Module-Packagehub-Subpackages-15-SP6-2025-1991=1
## Package List:
* SUSE Package Hub 15 15-SP7 (aarch64 ppc64le s390x x86_64)
* grafana-debuginfo-11.5.5-150200.3.72.2
* grafana-11.5.5-150200.3.72.2
* openSUSE Leap 15.6 (aarch64 ppc64le s390x x86_64)
* grafana-debuginfo-11.5.5-150200.3.72.2
* grafana-11.5.5-150200.3.72.2
* SUSE Package Hub 15 15-SP6 (aarch64 ppc64le s390x x86_64)
* grafana-debuginfo-11.5.5-150200.3.72.2
* grafana-11.5.5-150200.3.72.2
## References:
* https://www.suse.com/security/cve/CVE-2023-45288.html
* https://www.suse.com/security/cve/CVE-2024-9264.html
* https://www.suse.com/security/cve/CVE-2024-9476.html
* https://www.suse.com/security/cve/CVE-2025-22870.html
* https://www.suse.com/security/cve/CVE-2025-22872.html
* https://www.suse.com/security/cve/CVE-2025-2703.html
* https://www.suse.com/security/cve/CVE-2025-29923.html
* https://www.suse.com/security/cve/CVE-2025-3454.html
* https://bugzilla.suse.com/show_bug.cgi?id=1231844
* https://bugzilla.suse.com/show_bug.cgi?id=1233343
* https://bugzilla.suse.com/show_bug.cgi?id=1236510
* https://bugzilla.suse.com/show_bug.cgi?id=1236516
* https://bugzilla.suse.com/show_bug.cgi?id=1238686
* https://bugzilla.suse.com/show_bug.cgi?id=1238703
* https://bugzilla.suse.com/show_bug.cgi?id=1241683
* https://bugzilla.suse.com/show_bug.cgi?id=1241687
* https://bugzilla.suse.com/show_bug.cgi?id=1241809
* https://bugzilla.suse.com/show_bug.cgi?id=1243672
* https://bugzilla.suse.com/show_bug.cgi?id=1243714
* https://jira.suse.com/browse/MSQA-992
* https://jira.suse.com/browse/PED-12918
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.suse.com/pipermail/sle-security-updates/attachments/20250618/05738d1e/attachment.htm>
More information about the sle-security-updates
mailing list