CVE-2021-41090 - log back

CVE-2021-41090 edited at 08 Dec 2021 20:17:43
Notes
+ Workaround
+ ==========
+
+ To mitigate the issue, use non-inline secrets where possible. Not all configuration options may have a non-inline equivalent.
+
+ You also may desire to restrict API access to Grafana Agent, with some combination of:
+
+ - Restrict network interfaces Grafana Agent listens on through http_listen_address in the server block. 127.0.0.1 is the most restrictive, 0.0.0.0 is the default.
+ - Configure Grafana Agent to use HTTPS with client authentication.
+ - Use firewall rules to restrict external access to Grafana Agent's API.
CVE-2021-41090 edited at 08 Dec 2021 14:41:39
Severity
- Unknown
+ High
Remote
- Unknown
+ Remote
Type
- Unknown
+ Information disclosure
Description
+ A security issue has been found in Grafana Agent before version 0.21.2. Some inline secrets are exposed in plaintext over the Grafana Agent HTTP server:
+
+ - Inline secrets for metrics instance configs in the base YAML file are exposed at /-/config
+ - Inline secrets for integrations are exposed at /-/config
+ - Inline secrets for Consul ACL tokens and ETCD basic auth when configured for the scraping service at /-/config.
+ - Inline secrets for the Kafka receiver for OpenTelemetry-Collector tracing at /-/config.
+ - Inline secrets for metrics instance configs loaded from the scraping service are exposed at /agent/api/v1/configs/{name}.
+
+ Inline secrets will be exposed to anyone being able to reach these endpoints.
+
+ Secrets found in these sections are used for:
+
+ - Delivering metrics to a Prometheus Remote Write system
+ - Authenticating against a system for discovering Prometheus targets
+ - Authenticating against a system for collecting metrics (scrape_configs and integrations)
+ - Authenticating against a Consul or ETCD for storing configurations to distribute in scraping service mode
+ - Authenticating against Kafka for receiving traces
+
+ Non-inlined secrets, such as *_file-based secrets, are not impacted by this vulnerability.
References
+ https://github.com/grafana/agent/security/advisories/GHSA-9c4x-5hgq-q3wh
Notes
CVE-2021-41090 created at 08 Dec 2021 14:35:19