CVE-2022-39229 SUSE CVE security@suse.de SUSE Security Team SUSE CVE-2022-39229 Interim 1 10 2023-09-08T23:26:13Z current 2022-10-15T14:48:54Z 2023-09-08T23:26:13Z cve-database/bin/generate-cvrf-cve.pl 2020-12-27T01:00:00Z CVE-2022-39229 Grafana is an open source data visualization platform for metrics, logs, and traces. Versions prior to 9.1.8 and 8.5.14 allow one user to block another user's login attempt by registering someone else'e email address as a username. A Grafana user’s username and email address are unique fields, that means no other user can have the same username or email address as another user. A user can have an email address as a username. However, the login system allows users to log in with either username or email address. Since Grafana allows a user to log in with either their username or email address, this creates an usual behavior where `user_1` can register with one email address and `user_2` can register their username as `user_1`’s email address. This prevents `user_1` logging into the application since `user_1`'s password won’t match with `user_2`'s email address. Versions 9.1.8 and 8.5.14 contain a patch. There are no workarounds for this issue. The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). https://lists.suse.com/pipermail/sle-security-updates/2023-March/013936.html E-Mail link for SUSE-CU-2023:498-1 https://lists.suse.com/pipermail/sle-security-updates/2023-February/013729.html E-Mail link for SUSE-SU-2023:0352-1 https://lists.suse.com/pipermail/sle-security-updates/2023-February/013725.html E-Mail link for SUSE-SU-2023:0353-1 https://lists.suse.com/pipermail/sle-security-updates/2023-February/013726.html E-Mail link for SUSE-SU-2023:0362-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings Container ses/7.1/ceph/grafana:8.5.15.2.2.393 SUSE Enterprise Storage 6 SUSE Linux Enterprise Module for Package Hub 15 SP4 SUSE Linux Enterprise Module for Package Hub 15 SP5 SUSE Manager Tools 12 SUSE Manager Tools 15 SUSE Manager Tools for SLE Micro 5 openSUSE Leap 15.4 openSUSE Tumbleweed dracut-saltboot-0.1.1673279145.e7616bd-150000.1.44.1 grafana grafana-8.5.14-1.1 grafana-8.5.15-1.39.1 grafana-8.5.15-150000.1.39.1 grafana-8.5.15-150200.3.32.1 kiwi-desc-saltboot-0.1.1673279145.e7616bd-1.32.1 mgr-osad-4.3.7-1.42.1 mgr-osad-4.3.7-150000.1.42.1 mgr-push-4.3.5-1.24.1 mgr-push-4.3.5-150000.1.24.2 python2-mgr-osa-common-4.3.7-1.42.1 python2-mgr-osad-4.3.7-1.42.1 python2-mgr-push-4.3.5-1.24.1 python2-rhnlib-4.3.5-21.46.1 python2-spacewalk-check-4.3.14-52.83.1 python2-spacewalk-client-setup-4.3.14-52.83.1 python2-spacewalk-client-tools-4.3.14-52.83.1 python2-uyuni-common-libs-4.3.7-1.30.1 python3-mgr-osa-common-4.3.7-150000.1.42.1 python3-mgr-osad-4.3.7-150000.1.42.1 python3-mgr-push-4.3.5-150000.1.24.2 python3-rhnlib-4.3.5-150000.3.40.1 python3-spacewalk-check-4.3.14-150000.3.74.1 python3-spacewalk-client-setup-4.3.14-150000.3.74.1 python3-spacewalk-client-tools-4.3.14-150000.3.74.1 python3-uyuni-common-libs-4.3.7-150000.1.30.1 spacecmd-4.3.18-150000.3.92.1 spacecmd-4.3.18-38.115.1 spacewalk-check-4.3.14-150000.3.74.1 spacewalk-check-4.3.14-52.83.1 spacewalk-client-setup-4.3.14-150000.3.74.1 spacewalk-client-setup-4.3.14-52.83.1 spacewalk-client-tools-4.3.14-150000.3.74.1 spacewalk-client-tools-4.3.14-52.83.1 grafana-8.5.15-150200.3.32.1 as a component of Container ses/7.1/ceph/grafana:8.5.15.2.2.393 grafana-8.5.15-150200.3.32.1 as a component of SUSE Linux Enterprise Module for Package Hub 15 SP4 grafana-8.5.15-150200.3.32.1 as a component of SUSE Linux Enterprise Module for Package Hub 15 SP5 grafana-8.5.15-1.39.1 as a component of SUSE Manager Tools 12 kiwi-desc-saltboot-0.1.1673279145.e7616bd-1.32.1 as a component of SUSE Manager Tools 12 mgr-osad-4.3.7-1.42.1 as a component of SUSE Manager Tools 12 mgr-push-4.3.5-1.24.1 as a component of SUSE Manager Tools 12 python2-mgr-osa-common-4.3.7-1.42.1 as a component of SUSE Manager Tools 12 python2-mgr-osad-4.3.7-1.42.1 as a component of SUSE Manager Tools 12 python2-mgr-push-4.3.5-1.24.1 as a component of SUSE Manager Tools 12 python2-rhnlib-4.3.5-21.46.1 as a component of SUSE Manager Tools 12 python2-spacewalk-check-4.3.14-52.83.1 as a component of SUSE Manager Tools 12 python2-spacewalk-client-setup-4.3.14-52.83.1 as a component of SUSE Manager Tools 12 python2-spacewalk-client-tools-4.3.14-52.83.1 as a component of SUSE Manager Tools 12 python2-uyuni-common-libs-4.3.7-1.30.1 as a component of SUSE Manager Tools 12 spacecmd-4.3.18-38.115.1 as a component of SUSE Manager Tools 12 spacewalk-check-4.3.14-52.83.1 as a component of SUSE Manager Tools 12 spacewalk-client-setup-4.3.14-52.83.1 as a component of SUSE Manager Tools 12 spacewalk-client-tools-4.3.14-52.83.1 as a component of SUSE Manager Tools 12 dracut-saltboot-0.1.1673279145.e7616bd-150000.1.44.1 as a component of SUSE Manager Tools 15 grafana-8.5.15-150000.1.39.1 as a component of SUSE Manager Tools 15 mgr-osad-4.3.7-150000.1.42.1 as a component of SUSE Manager Tools 15 mgr-push-4.3.5-150000.1.24.2 as a component of SUSE Manager Tools 15 python3-mgr-osa-common-4.3.7-150000.1.42.1 as a component of SUSE Manager Tools 15 python3-mgr-osad-4.3.7-150000.1.42.1 as a component of SUSE Manager Tools 15 python3-mgr-push-4.3.5-150000.1.24.2 as a component of SUSE Manager Tools 15 python3-rhnlib-4.3.5-150000.3.40.1 as a component of SUSE Manager Tools 15 python3-spacewalk-check-4.3.14-150000.3.74.1 as a component of SUSE Manager Tools 15 python3-spacewalk-client-setup-4.3.14-150000.3.74.1 as a component of SUSE Manager Tools 15 python3-spacewalk-client-tools-4.3.14-150000.3.74.1 as a component of SUSE Manager Tools 15 python3-uyuni-common-libs-4.3.7-150000.1.30.1 as a component of SUSE Manager Tools 15 spacecmd-4.3.18-150000.3.92.1 as a component of SUSE Manager Tools 15 spacewalk-check-4.3.14-150000.3.74.1 as a component of SUSE Manager Tools 15 spacewalk-client-setup-4.3.14-150000.3.74.1 as a component of SUSE Manager Tools 15 spacewalk-client-tools-4.3.14-150000.3.74.1 as a component of SUSE Manager Tools 15 dracut-saltboot-0.1.1673279145.e7616bd-150000.1.44.1 as a component of SUSE Manager Tools for SLE Micro 5 dracut-saltboot-0.1.1673279145.e7616bd-150000.1.44.1 as a component of openSUSE Leap 15.4 grafana-8.5.15-150200.3.32.1 as a component of openSUSE Leap 15.4 spacecmd-4.3.18-150000.3.92.1 as a component of openSUSE Leap 15.4 grafana-8.5.14-1.1 as a component of openSUSE Tumbleweed grafana as a component of SUSE Enterprise Storage 6 Grafana is an open source data visualization platform for metrics, logs, and traces. Versions prior to 9.1.8 and 8.5.14 allow one user to block another user's login attempt by registering someone else'e email address as a username. A Grafana user’s username and email address are unique fields, that means no other user can have the same username or email address as another user. A user can have an email address as a username. However, the login system allows users to log in with either username or email address. Since Grafana allows a user to log in with either their username or email address, this creates an usual behavior where `user_1` can register with one email address and `user_2` can register their username as `user_1`’s email address. This prevents `user_1` logging into the application since `user_1`'s password won’t match with `user_2`'s email address. Versions 9.1.8 and 8.5.14 contain a patch. There are no workarounds for this issue. CVE-2022-39229 Container ses/7.1/ceph/grafana:8.5.15.2.2.393:grafana-8.5.15-150200.3.32.1 SUSE Linux Enterprise Module for Open Buildservice Development Tools 15 SP5:dracut-saltboot-0.1.1673279145.e7616bd-150000.1.44.1 SUSE Linux Enterprise Module for Open Buildservice Development Tools 15 SP5:grafana-8.5.15-150200.3.32.1 SUSE Linux Enterprise Module for Open Buildservice Development Tools 15 SP5:mgr-osa-dispatcher-4.3.7-150000.1.42.1 SUSE Linux Enterprise Module for Open Buildservice Development Tools 15 SP5:python2-uyuni-common-libs-4.3.7-150000.1.30.1 SUSE Linux Enterprise Module for Open Buildservice Development Tools 15 SP5:python3-mgr-osa-dispatcher-4.3.7-150000.1.42.1 SUSE Linux Enterprise Module for Open Buildservice Development Tools 15 SP5:spacecmd-4.3.18-150000.3.92.1 SUSE Linux Enterprise Module for Package Hub 15 SP4:grafana-8.5.15-150200.3.32.1 SUSE Linux Enterprise Module for Package Hub 15 SP5:grafana-8.5.15-150200.3.32.1 SUSE Manager Tools 12:grafana-8.5.15-1.39.1 SUSE Manager Tools 12:kiwi-desc-saltboot-0.1.1673279145.e7616bd-1.32.1 SUSE Manager Tools 12:mgr-osad-4.3.7-1.42.1 SUSE Manager Tools 12:mgr-push-4.3.5-1.24.1 SUSE Manager Tools 12:python2-mgr-osa-common-4.3.7-1.42.1 SUSE Manager Tools 12:python2-mgr-osad-4.3.7-1.42.1 SUSE Manager Tools 12:python2-mgr-push-4.3.5-1.24.1 SUSE Manager Tools 12:python2-rhnlib-4.3.5-21.46.1 SUSE Manager Tools 12:python2-spacewalk-check-4.3.14-52.83.1 SUSE Manager Tools 12:python2-spacewalk-client-setup-4.3.14-52.83.1 SUSE Manager Tools 12:python2-spacewalk-client-tools-4.3.14-52.83.1 SUSE Manager Tools 12:python2-uyuni-common-libs-4.3.7-1.30.1 SUSE Manager Tools 12:spacecmd-4.3.18-38.115.1 SUSE Manager Tools 12:spacewalk-check-4.3.14-52.83.1 SUSE Manager Tools 12:spacewalk-client-setup-4.3.14-52.83.1 SUSE Manager Tools 12:spacewalk-client-tools-4.3.14-52.83.1 SUSE Manager Tools 15:dracut-saltboot-0.1.1673279145.e7616bd-150000.1.44.1 SUSE Manager Tools 15:grafana-8.5.15-150000.1.39.1 SUSE Manager Tools 15:mgr-osad-4.3.7-150000.1.42.1 SUSE Manager Tools 15:mgr-push-4.3.5-150000.1.24.2 SUSE Manager Tools 15:python3-mgr-osa-common-4.3.7-150000.1.42.1 SUSE Manager Tools 15:python3-mgr-osad-4.3.7-150000.1.42.1 SUSE Manager Tools 15:python3-mgr-push-4.3.5-150000.1.24.2 SUSE Manager Tools 15:python3-rhnlib-4.3.5-150000.3.40.1 SUSE Manager Tools 15:python3-spacewalk-check-4.3.14-150000.3.74.1 SUSE Manager Tools 15:python3-spacewalk-client-setup-4.3.14-150000.3.74.1 SUSE Manager Tools 15:python3-spacewalk-client-tools-4.3.14-150000.3.74.1 SUSE Manager Tools 15:python3-uyuni-common-libs-4.3.7-150000.1.30.1 SUSE Manager Tools 15:spacecmd-4.3.18-150000.3.92.1 SUSE Manager Tools 15:spacewalk-check-4.3.14-150000.3.74.1 SUSE Manager Tools 15:spacewalk-client-setup-4.3.14-150000.3.74.1 SUSE Manager Tools 15:spacewalk-client-tools-4.3.14-150000.3.74.1 SUSE Manager Tools for SLE Micro 5:dracut-saltboot-0.1.1673279145.e7616bd-150000.1.44.1 openSUSE Leap 15.4:dracut-saltboot-0.1.1673279145.e7616bd-150000.1.44.1 openSUSE Leap 15.4:grafana-8.5.15-150200.3.32.1 openSUSE Leap 15.4:spacecmd-4.3.18-150000.3.92.1 openSUSE Tumbleweed:grafana-8.5.14-1.1 SUSE Enterprise Storage 6:grafana low 3.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L