CVE-2020-12459: Infoleak
An information-disclosure flaw was found in Grafana distributed by Red Hat. This flaw allows a local attacker access to potentially sensitive information such as secretkey and a bindpassword from the world-readable files /etc/grafana/grafana.ini and /etc/grafana/ldap.toml.
Other sources
For Grafana versions 6.x through 6.4.3 distributed by Red Hat, configuration files /etc/grafana/grafana.ini and /etc/grafana/ldap.toml which contains secretkey and bindpassword are world readable.
Grafana Versions 5.x : sets correct file permission 0640 ==================== %files [...] %attr(0640, root, grafana) %{sysconfdir}/%{name}/grafana.ini %attr(0640, root, grafana) %{sysconfdir}/%{name}/ldap.toml
Grafana Version 6.x through 6.4.3 : sets insecure file permission 0644 =================================
config defaults install -p -m 644 conf/distro-defaults.ini \ %{buildroot}%{sysconfdir}/%{binaryname}/grafana.ini install -p -m 644 conf/distro-defaults.ini \ %{buildroot}%{datadir}/%{binaryname}/conf/defaults.ini install -p -m 644 conf/ldap.toml %{buildroot}%{sysconfdir}/%{binaryname}/ldap.toml install -p -m 644 packaging/rpm/sysconfig/grafana-server \ %{buildroot}%{sysconfdir}/sysconfig/grafana-server
config files %dir %{sysconfdir}/%{binaryname} %config(noreplace) %attr(644, root, root) %{sysconfdir}/%{binaryname}/grafana.ini %config(noreplace) %attr(644, root, root) %{sysconfdir}/%{binaryname}/ldap.toml %config(noreplace) %{sysconfdir}/sysconfig/grafana-server
Notable fixes which removes readable bits: - change permissions of grafana.ini and ldap.toml to 640(contains secretkey/bindpassword)
Commit: - https://src.fedoraproject.org/rpms/grafana/c/fab93d67363eb0a9678d9faf160cc88237f26277
— Red Hat
In certain Red Hat packages for Grafana 6.x through 6.3.6, the configuration files /etc/grafana/grafana.ini and /etc/grafana/ldap.toml (which contain a secretkey and a bindpassword) are world readable.
In certain Red Hat packages for Grafana 6.x through 6.3.6, the configuration files /etc/grafana/grafana.ini and /etc/grafana/ldap.toml (which contain a secretkey and a bindpassword) are world readable.
— GitHub
Affected Software
Remediation
Information
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the severity of CVE-2020-12459?
CVE-2020-12459 is classified as an information-disclosure vulnerability that can expose sensitive information.
How do I fix CVE-2020-12459?
To fix CVE-2020-12459, upgrade to the patched versions of Grafana and associated packages as specified by Red Hat.
What are the affected versions of Grafana related to CVE-2020-12459?
Affected versions include Grafana versions below 6.7.4 and all versions before 7.2.1.
Who is affected by CVE-2020-12459?
Any organization using vulnerable versions of Grafana and its associated packages on Red Hat distributions is affected.
What information could be disclosed due to CVE-2020-12459?
CVE-2020-12459 can potentially expose sensitive information such as the secret_key and bind_password from specific configuration files.