Test ID:	1.3.6.1.4.1.25623.1.0.104715
Category:	Denial of Service
Title:	Grafana 7.3.0-beta1 < 8.5.24, 9.x < 9.2.17, 9.3.x < 9.3.13, 9.4.x < 9.4.9 DoS Vulnerability
Summary:	Grafana is prone to a denial of service (DoS) vulnerability in; the crewjam/saml library used for SAML integration.
Description:	Summary: Grafana is prone to a denial of service (DoS) vulnerability in the crewjam/saml library used for SAML integration. Vulnerability Insight: Grafana is using crewjam/saml library for SAML integration. On March 23, an advisory and relevant fix was published in the upstream library, which described a vulnerability allowing denial of service attack. Vulnerability Impact: The use of flate.NewReader in crewjam/saml does not limit the size of the input. The user could pass more than 1 MB of data in the HTTP request to the processing functions, which will be decompressed server-side using the Deflate algorithm. Therefore, after repeating the same request multiple times, it is possible to achieve a reliable crash since the operating system kills the process. In Grafana Enterprise, SAML single logout is using the aforementioned functions. Therefore, it's impacted by the vulnerability. Affected Software/OS: Grafana versions starting from 7.3.0-beta1 and prior to 8.5.24, 9.x prior to 9.2.17, 9.3.x prior to 9.3.13 and 9.4.x prior to 9.4.9. Solution: - Update to version 8.5.24, 9.2.17, 9.3.13, 9.4.9 or later. - As an alternative mitigation, disabling single logout in SAML or not using the SAML authentication entirely would mitigate the vulnerability. CVSS Score: 7.8 CVSS Vector: AV:N/AC:L/Au:N/C:N/I:N/A:C
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2023-28119 https://github.com/crewjam/saml/commit/8e9236867d176ad6338c870a84e2039aef8a5021 https://github.com/crewjam/saml/security/advisories/GHSA-5mqj-xc49-246p
Copyright	Copyright (C) 2023 Greenbone AG

This is only one of 145615 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.