Arch Linux Security Advisory ASA-202108-12 ========================================== Severity: Medium Date : 2021-08-10 CVE-ID : CVE-2021-36156 Package : loki Type : directory traversal Remote : Yes Link : https://security.archlinux.org/AVG-2250 Summary ======= The package loki before version 2.3.0-1 is vulnerable to directory traversal. Resolution ========== Upgrade to 2.3.0-1. # pacman -Syu "loki>=2.3.0-1" The problem has been fixed upstream in version 2.3.0. Workaround ========== None. Description =========== An issue was discovered in Grafana Loki through 2.2.1. The header value X-Scope-OrgID is used to construct file paths for rules files, and if crafted to conduct directory traversal such as a ../../sensitive/path/in/deployment pathname, then Loki will attempt to parse a rules file at that location and include some of the contents in the error message. Impact ====== A remote attacker could disclose some of the contents of arbitrary files through a crafted X-Scope-OrgID header. References ========== https://github.com/grafana/loki/pull/4020 https://github.com/grafana/loki/commit/2fd633cded9a97c8c6b29160549a157678d1f... https://security.archlinux.org/CVE-2021-36156