search

wazuh / wazuh-qa

Wazuh - Quality Assurance
GNU General Public License v2.0
61 stars 30 forks source link

Missing CVE-2023-4822 in grafana metadata package #5320

Closed Rebits closed 1 week ago

Rebits commented 2 weeks ago

Description

It has been detected Additional Vulnerability Detection End-to-End that Vulnerability Detector E2E grafana package metadata vulnerabilities do not contain CVE-2023-4822. It is necessary to include it for all the affected grafana versions

Rebits commented 2 weeks ago

Regarding https://nvd.nist.gov/vuln/detail/CVE-2023-4822, this vulnerability affects the following grafana packages

image

Currently, E2E test packages that should include this vulnerability are:

No substantial change is necessary in the test case due to expected nonvulnerable packages (grafana-9.5.13, grafana-9.4.17) are still not vulnerable

CVE-2023-4822 included in d19ab01a36c2f6bcf438c7dc675f5c24a76420be

Currently testing in a local environment. Further information regarding changes will be provided when test is over

santipadilla commented 1 week ago

LGTM