[ASA-202108-12] loki: directory traversal

[Jonas Witschel]

Arch Linux Security Advisory ASA-202108-12
==========================================

Severity: Medium
Date    : 2021-08-10
CVE-ID  : CVE-2021-36156
Package : loki
Type    : directory traversal
Remote  : Yes
Link    : https://security.archlinux.org/AVG-2250

Summary
=======

The package loki before version 2.3.0-1 is vulnerable to directory
traversal.

Resolution
==========

Upgrade to 2.3.0-1.

# pacman -Syu "loki>=2.3.0-1"

The problem has been fixed upstream in version 2.3.0.

Workaround
==========

None.

Description
===========

An issue was discovered in Grafana Loki through 2.2.1. The header value
X-Scope-OrgID is used to construct file paths for rules files, and if
crafted to conduct directory traversal such as a
../../sensitive/path/in/deployment pathname, then Loki will attempt to
parse a rules file at that location and include some of the contents in
the error message.

Impact
======

A remote attacker could disclose some of the contents of arbitrary
files through a crafted X-Scope-OrgID header.

References
==========

https://github.com/grafana/loki/pull/4020
https://github.com/grafana/loki/commit/2fd633cded9a97c8c6b29160549a157678d1fa2f
https://security.archlinux.org/CVE-2021-36156
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 833 bytes
Desc: not available
URL: <https://lists.archlinux.org/pipermail/arch-security/attachments/20210813/4d62d223/attachment.sig>