Linux · Security advisory · November 9, 2021

RHSA-2021:4226: grafana security update

RHSA-2021:4226, released November 9, 2021, fixes 5 CVEs in grafana (version 0:7.5.9-4.el8). None of them is reported as exploited. Patch Radar priority: High.

High

CVEs closed

None rated Critical

Exploited

None reported

Exploitation more likely

Vendor assessment

Highest EPSS

0.8304

99th percentile

Priority of the 5 CVEs

Patch now 0
                                Urgent 0
                                High 5
                                Routine 0

Fixed package versions

Product	Release	Fixed in
grafana	RHEL 8	0:7.5.9-4.el8

CVEs this fix closes

Priority	CVE	Title	CVSS	EPSS	Exploitation
High	CVE-2021-27358	grafana: Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB & OpenTSDB	7.5	0.8304	None reported
High	CVE-2021-34558	grafana: Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB & OpenTSDB	7.5	0.0698	None reported
High	CVE-2021-33195	grafana: Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB & OpenTSDB	7.5	0.0320	None reported
High	CVE-2021-3114	golang-bin: Go Toolset provides the Go programming language tools and libraries	7.5	0.0270	None reported
High	CVE-2021-33197	grafana: Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB & OpenTSDB	7.5	0.0226	None reported