rpms/grafana
7
0
Fork 0
Code Issues Pull Requests Releases Activity

import OL grafana-10.2.6-18.el9_7

Browse Source
This commit is contained in:
eabdullin 2026-02-19 07:19:13 +00:00
parent bc3ab26d6e
commit 5dfd276d25
2 changed files with 59 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

49
SOURCES/0014-Fix-CVE-2026-21721.patch Normal file
View File

@ -0,0 +1,49 @@
From 3efa5e004426fed8f25ec513f2dce4658e3b6564 Mon Sep 17 00:00:00 2001
From: Sam Feifer <sfeifer@redhat.com>
Date: Mon, 16 Feb 2026 15:35:19 -0500
Subject: [PATCH] Fix CVE-2026-21721
---
pkg/api/api.go | 10 ++++++----
1 file changed, 6 insertions(+), 4 deletions(-)
diff --git a/pkg/api/api.go b/pkg/api/api.go
index 3db3cbafe73..b8c1dd5736e 100644
--- a/pkg/api/api.go
+++ b/pkg/api/api.go
@@ -461,12 +461,13 @@ func (hs *HTTPServer) registerRoutes() {
dashboardRoute.Get("/uid/:uid", authorize(ac.EvalPermission(dashboards.ActionDashboardsRead)), routing.Wrap(hs.GetDashboard))
dashboardRoute.Delete("/uid/:uid", authorize(ac.EvalPermission(dashboards.ActionDashboardsDelete)), routing.Wrap(hs.DeleteDashboardByUID))
dashboardRoute.Group("/uid/:uid", func(dashUidRoute routing.RouteRegister) {
+ dashUIDScope := dashboards.ScopeDashboardsProvider.GetResourceScopeUID(ac.Parameter(":uid"))
dashUidRoute.Get("/versions", authorize(ac.EvalPermission(dashboards.ActionDashboardsWrite)), routing.Wrap(hs.GetDashboardVersions))
dashUidRoute.Post("/restore", authorize(ac.EvalPermission(dashboards.ActionDashboardsWrite)), routing.Wrap(hs.RestoreDashboardVersion))
dashUidRoute.Get("/versions/:id", authorize(ac.EvalPermission(dashboards.ActionDashboardsWrite)), routing.Wrap(hs.GetDashboardVersion))
dashUidRoute.Group("/permissions", func(dashboardPermissionRoute routing.RouteRegister) {
- dashboardPermissionRoute.Get("/", authorize(ac.EvalPermission(dashboards.ActionDashboardsPermissionsRead)), routing.Wrap(hs.GetDashboardPermissionList))
- dashboardPermissionRoute.Post("/", authorize(ac.EvalPermission(dashboards.ActionDashboardsPermissionsWrite)), routing.Wrap(hs.UpdateDashboardPermissions))
+ dashboardPermissionRoute.Get("/", authorize(ac.EvalPermission(dashboards.ActionDashboardsPermissionsRead, dashUIDScope)), routing.Wrap(hs.GetDashboardPermissionList))
+ dashboardPermissionRoute.Post("/", authorize(ac.EvalPermission(dashboards.ActionDashboardsPermissionsWrite, dashUIDScope)), routing.Wrap(hs.UpdateDashboardPermissions))
})
})
@@ -481,13 +482,14 @@ func (hs *HTTPServer) registerRoutes() {
// Deprecated: use /uid/:uid API instead.
dashboardRoute.Group("/id/:dashboardId", func(dashIdRoute routing.RouteRegister) {
+ dashIDScope := dashboards.ScopeDashboardsProvider.GetResourceScope(ac.Parameter(":dashboardId"))
dashIdRoute.Get("/versions", authorize(ac.EvalPermission(dashboards.ActionDashboardsWrite)), routing.Wrap(hs.GetDashboardVersions))
dashIdRoute.Get("/versions/:id", authorize(ac.EvalPermission(dashboards.ActionDashboardsWrite)), routing.Wrap(hs.GetDashboardVersion))
dashIdRoute.Post("/restore", authorize(ac.EvalPermission(dashboards.ActionDashboardsWrite)), routing.Wrap(hs.RestoreDashboardVersion))
dashIdRoute.Group("/permissions", func(dashboardPermissionRoute routing.RouteRegister) {
- dashboardPermissionRoute.Get("/", authorize(ac.EvalPermission(dashboards.ActionDashboardsPermissionsRead)), routing.Wrap(hs.GetDashboardPermissionList))
- dashboardPermissionRoute.Post("/", authorize(ac.EvalPermission(dashboards.ActionDashboardsPermissionsWrite)), routing.Wrap(hs.UpdateDashboardPermissions))
+ dashboardPermissionRoute.Get("/", authorize(ac.EvalPermission(dashboards.ActionDashboardsPermissionsRead, dashIDScope)), routing.Wrap(hs.GetDashboardPermissionList))
+ dashboardPermissionRoute.Post("/", authorize(ac.EvalPermission(dashboards.ActionDashboardsPermissionsWrite, dashIDScope)), routing.Wrap(hs.UpdateDashboardPermissions))
})
})
})
--
2.52.0

11
SPECS/grafana.spec
View File

@ -26,7 +26,7 @@ end}
Name: grafana
Version: 10.2.6
Release: 17%{?dist}
Release: 18%{?dist}
Summary: Metrics dashboard and graph editor
License: AGPL-3.0-only
URL: https://grafana.org
@ -81,6 +81,7 @@ Patch10: 0010-remove-bcrypt-references.patch
Patch11: 0011-fix-dompurify-CVE.patch
Patch12: 0012-fix-jwt-CVE.patch
Patch13: 0013-fix-CVE-2025-4123.patch
Patch14: 0014-Fix-CVE-2026-21721.patch
# Patches affecting the vendor tarball
Patch1001: 1001-vendor-patch-removed-backend-crypto.patch
@ -776,6 +777,7 @@ rm -r plugins-bundled
%patch -P 11 -p1
%patch -P 12 -p1
%patch -P 13 -p1
%patch -P 14 -p1
%patch -P 1001 -p1
%if %{enable_fips_mode}
@ -1021,6 +1023,13 @@ done
%ghost %verify(not md5 size mode mtime) %{_sharedstatedir}/selinux/*/active/modules/200/grafana
%changelog
* Tue Feb 17 2026 Sam Feifer <sfeifer@redhat.com> 10.2.6-17
- Resolves RHEL-144959: CVE-2026-21721
- Resolves RHEL-146863: CVE-2025-61726
- Resolves RHEL-147081: CVE-2025-61729
- Resolves RHEL-147370: CVE-2025-61728
- Resolves RHEL-149621: CVE-2025-68121
* Wed Dec 3 2025 Sam Feifer <sfeifer@redhat.com> 10.2.6-17
- Resolves RHEL-125692: CVE-2025-58183
- Resolves RHEL-120426: Grafana-selinux prevents plugins from searching cgroups