Red Hat Product Security released an important security advisory (RHSA-2024:3265) for Grafana packages in Red Hat Enterprise Linux 8. The advisory addresses two vulnerabilities: CVE-2024-1313, an authorization bypass vulnerability in Grafana, and CVE-2024-1394, memory leaks in golang-fips/openssl during RSA payload encryption and decryption. The update fixes these issues in Grafana version 9.2.10-16.el8_10 across multiple architectures. No CVSS scores are provided in the advisory, but the authorization bypass is considered high severity. The advisory includes detailed package updates and instructions for applying the fix.

The authorization bypass vulnerability (CVE-2024-1313) in Grafana could allow unauthorized users to bypass access controls, potentially exposing sensitive metrics or dashboards. The memory leak vulnerability (CVE-2024-1394) in golang-fips/openssl could lead to resource exhaustion on affected systems. Red Hat rates the overall impact as important, with the authorization bypass specifically rated high severity. There are no known exploits in the wild at the time of the advisory.

Red Hat has released updated Grafana packages for Red Hat Enterprise Linux 8 that address these vulnerabilities. Users should apply the official security update as detailed in Red Hat advisory RHSA-2024:3265 and the referenced article https://access.redhat.com/articles/11258. Applying these updates will remediate both the authorization bypass and memory leak issues. No additional mitigation steps are indicated or required beyond applying the official patches.