[ASA-202108-12] loki: directory traversal
diabonas at archlinux.org
Fri Aug 13 18:07:30 UTC 2021
Arch Linux Security Advisory ASA-202108-12
Date : 2021-08-10
CVE-ID : CVE-2021-36156
Package : loki
Type : directory traversal
Remote : Yes
Link : https://security.archlinux.org/AVG-2250
The package loki before version 2.3.0-1 is vulnerable to directory
Upgrade to 2.3.0-1.
# pacman -Syu "loki>=2.3.0-1"
The problem has been fixed upstream in version 2.3.0.
An issue was discovered in Grafana Loki through 2.2.1. The header value
X-Scope-OrgID is used to construct file paths for rules files, and if
crafted to conduct directory traversal such as a
../../sensitive/path/in/deployment pathname, then Loki will attempt to
parse a rules file at that location and include some of the contents in
the error message.
A remote attacker could disclose some of the contents of arbitrary
files through a crafted X-Scope-OrgID header.
-------------- next part --------------
A non-text attachment was scrubbed...
Size: 833 bytes
Desc: not available
More information about the arch-security