What is RHSA-2023:6972?

RHSA-2023:6972 is a security advisory published by Red Hat Product Security with Medium severity. Red Hat Security Advisory: grafana security and enhancement update

Which CVE IDs does RHSA-2023:6972 cover?

RHSA-2023:6972 covers the following CVE IDs: CVE-2023-3128, CVE-2022-37601. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of RHSA-2023:6972?

RHSA-2023:6972 has a CVSS v3 base score of 9.8, published by Red Hat Product Security.

Which products are affected by RHSA-2023:6972?

RHSA-2023:6972 affects 14 products, including: Red Hat Enterprise Linux AppStream (v. 8); grafana-0:9.2.10-7.el8_9.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 8); grafana-0:9.2.10-7.el8_9.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 8); grafana-0:9.2.10-7.el8_9.s390x as a component of Red Hat Enterprise Linux AppStream (v. 8); grafana-0:9.2.10-7.el8_9.src as a component of Red Hat Enterprise Linux AppStream (v. 8); and others — see the full list on the advisory page.

RHSA-2023:6972MediumCVSS 9.8

Red Hat Security Advisory: grafana security and enhancement update

Vendor

Red Hat Product Security

Published

November 14, 2023

Last Modified

August 4, 2026

🔗 CVE IDs covered (2)

CVE-2023-3128 →CVE-2022-37601 →

📋 Description

CVE-2022-37601 — loader-utils: prototype pollution in function parseQuery in parseQuery.js CVE-2023-3128 — grafana: account takeover possible when using Azure AD OAuth

🎯 Affected products14

Red Hat Enterprise Linux AppStream (v. 8)
grafana-0:9.2.10-7.el8_9.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 8)
grafana-0:9.2.10-7.el8_9.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 8)
grafana-0:9.2.10-7.el8_9.s390x as a component of Red Hat Enterprise Linux AppStream (v. 8)
grafana-0:9.2.10-7.el8_9.src as a component of Red Hat Enterprise Linux AppStream (v. 8)
grafana-0:9.2.10-7.el8_9.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8)
grafana-debuginfo-0:9.2.10-7.el8_9.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 8)
grafana-debuginfo-0:9.2.10-7.el8_9.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 8)
grafana-debuginfo-0:9.2.10-7.el8_9.s390x as a component of Red Hat Enterprise Linux AppStream (v. 8)
grafana-debuginfo-0:9.2.10-7.el8_9.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8)
grafana-debugsource-0:9.2.10-7.el8_9.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 8)
grafana-debugsource-0:9.2.10-7.el8_9.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 8)
grafana-debugsource-0:9.2.10-7.el8_9.s390x as a component of Red Hat Enterprise Linux AppStream (v. 8)
grafana-debugsource-0:9.2.10-7.el8_9.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8)

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Workaround: We recommend disabling Active Directory in the Grafana configuration file until a fix is provided.

🔗 CVE IDs covered (2)

📋 Description

🎯 Affected products14

✅ Remediation

🔗 References (7)