CVE-2021-41090: Cleartext Storage of Sensitive Information (CWE-312)
value: Grafana Agent is a telemetry collector for sending metrics, logs, and trace data to the opinionated Grafana observability stack. Prior to versions 0.20.1 and 0.21.2, inline secrets defined within a metrics instance config are exposed in plaintext over two endpoints: metrics instance configs defined in the base YAML file are exposed at `/-/config` and metrics instance configs defined for the scraping service are exposed at `/agent/api/v1/configs/:key`. Inline secrets will be exposed to anyone being able to reach these endpoints. If HTTPS with client authentication is not configured, these endpoints are accessible to unauthenticated users. Secrets found in these sections are used for delivering metrics to a Prometheus Remote Write system, authenticating against a system for discovering Prometheus targets, and authenticating against a system for collecting metrics. This does not apply for non-inlined secrets, such as `*_file` based secrets. This issue is patched in Grafana Agent versions 0.20.1 and 0.21.2. A few workarounds are available. Users who cannot upgrade should use non-inline secrets where possible. Users may also desire to restrict API access to Grafana Agent with some combination of restricting the network interfaces Grafana Agent listens on through `http_listen_address` in the `server` block, configuring Grafana Agent to use HTTPS with client authentication, and/or using firewall rules to restrict external access to Grafana Agent's API.
CWE description: The product stores sensitive information in cleartext within a resource that might be accessible to another control sphere.
CVSS v3 base score: 7.5
Published: 2021-12-08T17:15Z
Repository: https://github.com/grafana/agent
Language: Markdown
Files changed: CHANGELOG.md, docs/configuration/integrations/node-exporter-config.md, docs/configuration/integrations/process-exporter-config.md, docs/getting-started/_index.md, docs/operator/custom-resource-quickstart.md, docs/operator/getting-started.md, docs/upgrade-guide/_index.md, pkg/operator/defaults.go, production/README.md, production/grafanacloud-install.sh, production/kubernetes/agent-bare.yaml, production/kubernetes/agent-loki.yaml, production/kubernetes/agent-traces.yaml, production/kubernetes/build/lib/version.libsonnet, production/kubernetes/install-bare.sh, production/tanka/grafana-agent/v1/main.libsonnet, production/tanka/grafana-agent/v2/internal/base.libsonnet, production/tanka/grafana-agent/v2/internal/syncer.libsonnet
Commit date: 2021-12-08 08:40:17 -0500
Commit message: announce patch releases for cve-2021-41090 (#1152)


Diff: diff --git a/CHANGELOG.md b/CHANGELOG.md
index c3020347..820d0dc8 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -3,10 +3,20 @@
 - [FEATURE] (beta) Enable experimental config urls for fetching remote configs. Currently,
    only HTTP/S is supported. Use `-experiment.config-urls.enable` flag to turn this on. (@rlankfo)
 
 - [ENHANCEMENT] Traces: Improved pod association in PromSD processor (@mapno)
 
+# v0.21.2 (2021-12-08)
+
+- [SECURITY] This release contains a fix for
+  [CVE-2021-41090](https://github.com/grafana/agent/security/advisories/GHSA-9c4x-5hgq-q3wh).
+
+- [CHANGE] This release disables the existing `/-/config` and
+  `/agent/api/v1/configs/{name}` endpoitns by default. Pass the
+  `--config.enable-read-api` flag at the command line to opt in to these
+  endpoints.
+
 # v0.21.1 (2021-11-18)
 
 - [BUGFIX] Fix panic when using postgres_exporter integration (@saputradharma)
 
 - [BUGFIX] Fix panic when dnsamsq_exporter integration tried to log a warning (@rfratto)
@@ -45,10 +55,22 @@
 
 - [CHANGE] Self-scraped integrations will now use an SUO-specific value for the `instance` label. (@rfratto)
 
 - [CHANGE] Traces: Changed service graphs store implementation to improve CPU performance (@mapno)
 
+# v0.20.1 (2021-12-08)
+
+*NOTE*: The fixes in this patch are only present in v0.20.1 and >=v0.21.2.
+
+- [SECURITY] This release contains a fix for
+  [CVE-2021-41090](https://github.com/grafana/agent/security/advisories/GHSA-9c4x-5hgq-q3wh).
+
+- [CHANGE] This release disables the existing `/-/config` and
+  `/agent/api/v1/configs/{name}` endpoitns by default. Pass the
+  `--config.enable-read-api` flag at the command line to opt in to these
+  endpoints.
+
 # v0.20.0 (2021-10-28)
 
 - [FEATURE] Operator: The Grafana Agent Operator can now generate a Kubelet
   service to allow a ServiceMonitor to collect Kubelet and cAdvisor metrics.
   This requires passing a `--kubelet-service` flag to the Operator in
diff --git a/docs/configuration/integrations/node-exporter-config.md b/docs/configuration/integrations/node-exporter-config.md
index 42d6c487..d44d675a 100644
--- a/docs/configuration/integrations/node-exporter-config.md
+++ b/docs/configuration/integrations/node-exporter-config.md
@@ -24,11 +24,11 @@ docker run \
   -v "/:/host/root:ro,rslave" \
   -v "/sys:/host/sys:ro,rslave" \
   -v "/proc:/host/proc:ro,rslave" \
   -v /tmp/agent:/etc/agent \
   -v /path/to/config.yaml:/etc/agent-config/agent.yaml \
-  grafana/agent:v0.21.1 \
+  grafana/agent:v0.21.2 \
   --config.file=/etc/agent-config/agent.yaml
 ```
 
 Use this configuration file for testing out `node_exporter` support, replacing
 the `remote_write` settings with settings appropriate for you:
@@ -64,11 +64,11 @@ apiVersion: v1
 kind: Pod
 metadata:
   name: agent
 spec:
   containers:
-  - image: grafana/agent:v0.21.1
+  - image: grafana/agent:v0.21.2
     name: agent
     args:
     - --config.file=/etc/agent-config/agent.yaml
     securityContext:
       capabilities:
diff --git a/docs/configuration/integrations/process-exporter-config.md b/docs/configuration/integrations/process-exporter-config.md
index 3e0ccb7d..d5e42884 100644
--- a/docs/configuration/integrations/process-exporter-config.md
+++ b/docs/configuration/integrations/process-exporter-config.md
@@ -16,11 +16,11 @@ folders from the host system so the integration can monitor them:
 ```
 docker run \
   -v "/proc:/proc:ro" \
   -v /tmp/agent:/etc/agent \
   -v /path/to/config.yaml:/etc/agent-config/agent.yaml \
-  grafana/agent:v0.21.1 \
+  grafana/agent:v0.21.2 \
   --config.file=/etc/agent-config/agent.yaml
 ```
 
 Replace `/path/to/config.yaml` with the appropriate path on your host system
 where an Agent config file can be found.
@@ -33,11 +33,11 @@ apiVersion: v1
 kind: Pod
 metadata:
   name: agent
 spec:
   containers:
-  - image: grafana/agent:v0.21.1
+  - image: grafana/agent:v0.21.2
     name: agent
     args:
     - --config.file=/etc/agent-config/agent.yaml
     volumeMounts:
     - name: procfs
diff --git a/docs/getting-started/_index.md b/docs/getting-started/_index.md
index 8e162954..bf477d94 100644
--- a/docs/getting-started/_index.md
+++ b/docs/getting-started/_index.md
@@ -24,11 +24,11 @@ See the list of [Community Projects](#community-projects) for the community-driv
 
 ```
 docker run \
   -v /tmp/agent:/etc/agent/data \
   -v /path/to/config.yaml:/etc/agent/agent.yaml \
-  grafana/agent:v0.21.1
+  grafana/agent:v0.21.2
 ```
 
 Replace `/tmp/agent` with the folder you wish to store WAL data in. WAL data is
 where metrics are stored before they are sent to Prometheus. Old WAL data is
 cleaned up every hour, and will be used for recovering if the process happens to
diff --git a/docs/operator/custom-resource-quickstart.md b/docs/operator/custom-resource-quickstart.md
index 57160a08..bfef07d9 100644
--- a/docs/operator/custom-resource-quickstart.md
+++ b/docs/operator/custom-resource-quickstart.md
@@ -41,11 +41,11 @@ metadata:
   name: grafana-agent
   namespace: default
   labels:
     app: grafana-agent
 spec:
-  image: grafana/agent:v0.21.1
+  image: grafana/agent:v0.21.2
   logLevel: info
   serviceAccountName: grafana-agent
   metrics:
     instanceSelector:
       matchLabels:
diff --git a/docs/operator/getting-started.md b/docs/operator/getting-started.md
index 662fccbd..fe11b954 100644
--- a/docs/operator/getting-started.md
+++ b/docs/operator/getting-started.md
@@ -70,11 +70,11 @@ spec:
         app: grafana-agent-operator
     spec:
       serviceAccountName: grafana-agent-operator
       containers:
       - name: operator
-        image: grafana/agent-operator:v0.21.1
+        image: grafana/agent-operator:v0.21.2
         args:
         - --kubelet-service=default/kubelet
 ---
 
 apiVersion: v1
diff --git a/docs/upgrade-guide/_index.md b/docs/upgrade-guide/_index.md
index 299c6be7..bff63e6a 100644
--- a/docs/upgrade-guide/_index.md
+++ b/docs/upgrade-guide/_index.md
@@ -10,10 +10,20 @@ releases and how to migrate to newer versions.
 
 ## Unreleased Changes
 
 These changes will come in a future version.
 
+## v0.21.2, v0.20.1
+
+### Disabling of config retrieval enpoints
+
+These two patch releases, as part of a fix for
+[CVE-2021-41090](https://github.com/grafana/agent/security/advisories/GHSA-9c4x-5hgq-q3wh),
+disable the `/-/config` and `/agent/api/v1/configs/{name}` endpoints by
+default. Pass the `--config.enable-read-api` flag at the command line to
+re-enable them.
+
 ## v0.21.0
 
 ### Integrations: Change in how instance labels are handled (Breaking change)
 
 Integrations will now use a SUO-specific `instance` label value. Integrations
diff --git a/pkg/operator/defaults.go b/pkg/operator/defaults.go
index efc54e6f..e0189dc0 100644
--- a/pkg/operator/defaults.go
+++ b/pkg/operator/defaults.go
@@ -13,12 +13,14 @@ var (
 		"v0.18.2",
 		"v0.18.3",
 		"v0.18.4",
 		"v0.19.0",
 		"v0.20.0",
+		"v0.20.1",
 		"v0.21.0",
 		"v0.21.1",
+		"v0.21.2",
 
 		// NOTE(rfratto): when performing an upgrade, add the newest version above instead of changing the existing reference.
 	}
 
 	DefaultAgentVersion   = AgentCompatibilityMatrix[len(AgentCompatibilityMatrix)-1]
diff --git a/production/README.md b/production/README.md
index 020deb53..2fe50925 100644
--- a/production/README.md
+++ b/production/README.md
@@ -25,11 +25,11 @@ directory on your host that you want the agent to store its WAL.
 
 ```
 docker run \
   -v /tmp/agent:/etc/agent/data \
   -v /path/to/config.yaml:/etc/agent/agent.yaml \
-  grafana/agent:v0.21.1
+  grafana/agent:v0.21.2
 ```
 
 ## Running the Agent locally
 
 Currently, you must provide your own system configuration files to run the
diff --git a/production/grafanacloud-install.sh b/production/grafanacloud-install.sh
index 701dfddb..b7acda2b 100755
--- a/production/grafanacloud-install.sh
+++ b/production/grafanacloud-install.sh
@@ -48,11 +48,11 @@ ARCH=${ARCH:=amd64}
 PACKAGE_SYSTEM=${PACKAGE_SYSTEM:=}
 
 #
 # Global constants.
 #
-RELEASE_VERSION="0.21.1"
+RELEASE_VERSION="0.21.2"
 
 RELEASE_URL="https://github.com/grafana/agent/releases/download/v${RELEASE_VERSION}"
 DEB_URL="${RELEASE_URL}/grafana-agent-${RELEASE_VERSION}-1.${ARCH}.deb"
 RPM_URL="${RELEASE_URL}/grafana-agent-${RELEASE_VERSION}-1.${ARCH}.rpm"
 
diff --git a/production/kubernetes/agent-bare.yaml b/production/kubernetes/agent-bare.yaml
index ccc52c95..cea60c76 100644
--- a/production/kubernetes/agent-bare.yaml
+++ b/production/kubernetes/agent-bare.yaml
@@ -64,11 +64,11 @@ spec:
         env:
         - name: HOSTNAME
           valueFrom:
             fieldRef:
               fieldPath: spec.nodeName
-        image: grafana/agent:v0.21.1
+        image: grafana/agent:v0.21.2
         imagePullPolicy: IfNotPresent
         name: agent
         ports:
         - containerPort: 12345
           name: http-metrics
diff --git a/production/kubernetes/agent-loki.yaml b/production/kubernetes/agent-loki.yaml
index 2f361e72..bd746b2b 100644
--- a/production/kubernetes/agent-loki.yaml
+++ b/production/kubernetes/agent-loki.yaml
@@ -62,11 +62,11 @@ spec:
         env:
         - name: HOSTNAME
           valueFrom:
             fieldRef:
               fieldPath: spec.nodeName
-        image: grafana/agent:v0.21.1
+        image: grafana/agent:v0.21.2
         imagePullPolicy: IfNotPresent
         name: agent
         ports:
         - containerPort: 8080
           name: http-metrics
diff --git a/production/kubernetes/agent-traces.yaml b/production/kubernetes/agent-traces.yaml
index b24195c7..51b82f7e 100644
--- a/production/kubernetes/agent-traces.yaml
+++ b/production/kubernetes/agent-traces.yaml
@@ -107,11 +107,11 @@ spec:
         env:
         - name: HOSTNAME
           valueFrom:
             fieldRef:
               fieldPath: spec.nodeName
-        image: grafana/agent:v0.21.1
+        image: grafana/agent:v0.21.2
         imagePullPolicy: IfNotPresent
         name: agent
         ports:
         - containerPort: 8080
           name: http-metrics
diff --git a/production/kubernetes/build/lib/version.libsonnet b/production/kubernetes/build/lib/version.libsonnet
index 1f68d087..47c428aa 100644
--- a/production/kubernetes/build/lib/version.libsonnet
+++ b/production/kubernetes/build/lib/version.libsonnet
@@ -1 +1 @@
-'grafana/agent:v0.21.1'
+'grafana/agent:v0.21.2'
diff --git a/production/kubernetes/install-bare.sh b/production/kubernetes/install-bare.sh
index 80c0e52f..cfcef950 100644
--- a/production/kubernetes/install-bare.sh
+++ b/production/kubernetes/install-bare.sh
@@ -23,11 +23,11 @@ check_installed() {
 }
 
 check_installed curl
 check_installed envsubst
 
-MANIFEST_BRANCH=v0.21.1
+MANIFEST_BRANCH=v0.21.2
 MANIFEST_URL=${MANIFEST_URL:-https://raw.githubusercontent.com/grafana/agent/${MANIFEST_BRANCH}/production/kubernetes/agent-bare.yaml}
 NAMESPACE=${NAMESPACE:-default}
 
 export NAMESPACE
 
diff --git a/production/tanka/grafana-agent/v1/main.libsonnet b/production/tanka/grafana-agent/v1/main.libsonnet
index fe8af7c3..cda3bffd 100644
--- a/production/tanka/grafana-agent/v1/main.libsonnet
+++ b/production/tanka/grafana-agent/v1/main.libsonnet
@@ -13,12 +13,12 @@ local service = k.core.v1.service;
 (import './lib/scraping_service.libsonnet') +
 (import './lib/logs.libsonnet') +
 (import './lib/traces.libsonnet') +
 {
   _images:: {
-    agent: 'grafana/agent:v0.21.1',
-    agentctl: 'grafana/agentctl:v0.21.1',
+    agent: 'grafana/agent:v0.21.2',
+    agentctl: 'grafana/agentctl:v0.21.2',
   },
 
   // new creates a new DaemonSet deployment of the grafana-agent. By default,
   // the deployment will do no collection. You must merge the result of this
   // function with one or more of the following:
diff --git a/production/tanka/grafana-agent/v2/internal/base.libsonnet b/production/tanka/grafana-agent/v2/internal/base.libsonnet
index 15b769b1..c07b012d 100644
--- a/production/tanka/grafana-agent/v2/internal/base.libsonnet
+++ b/production/tanka/grafana-agent/v2/internal/base.libsonnet
@@ -8,12 +8,12 @@ function(name='grafana-agent', namespace='') {
   local serviceAccount = k.core.v1.serviceAccount,
 
   local this = self,
 
   _images:: {
-    agent: 'grafana/agent:v0.21.1',
-    agentctl: 'grafana/agentctl:v0.21.1',
+    agent: 'grafana/agent:v0.21.2',
+    agentctl: 'grafana/agentctl:v0.21.2',
   },
   _config:: {
     name: name,
     namespace: namespace,
     config_hash: true,
diff --git a/production/tanka/grafana-agent/v2/internal/syncer.libsonnet b/production/tanka/grafana-agent/v2/internal/syncer.libsonnet
index 2f0050d8..a9067259 100644
--- a/production/tanka/grafana-agent/v2/internal/syncer.libsonnet
+++ b/production/tanka/grafana-agent/v2/internal/syncer.libsonnet
@@ -12,11 +12,11 @@ function(
   namespace='',
   config={},
 ) {
   local _config = {
     api: error 'api must be set',
-    image: 'grafana/agentctl:v0.21.1',
+    image: 'grafana/agentctl:v0.21.2',
     schedule: '*/5 * * * *',
     configs: [],
   } + config,
 
   local this = self,

Vulnerable code:   grafana/agent:v0.21.1 \
  - image: grafana/agent:v0.21.1
  grafana/agent:v0.21.1 \
  - image: grafana/agent:v0.21.1
  grafana/agent:v0.21.1
  image: grafana/agent:v0.21.1
        image: grafana/agent-operator:v0.21.1
  grafana/agent:v0.21.1
RELEASE_VERSION="0.21.1"
        image: grafana/agent:v0.21.1
        image: grafana/agent:v0.21.1
        image: grafana/agent:v0.21.1
'grafana/agent:v0.21.1'
MANIFEST_BRANCH=v0.21.1
    agent: 'grafana/agent:v0.21.1',
    agentctl: 'grafana/agentctl:v0.21.1',
    agent: 'grafana/agent:v0.21.1',
    agentctl: 'grafana/agentctl:v0.21.1',
    image: 'grafana/agentctl:v0.21.1',
Fixed code: # v0.21.2 (2021-12-08)

- [SECURITY] This release contains a fix for
  [CVE-2021-41090](https://github.com/grafana/agent/security/advisories/GHSA-9c4x-5hgq-q3wh).

- [CHANGE] This release disables the existing `/-/config` and
  `/agent/api/v1/configs/{name}` endpoitns by default. Pass the
  `--config.enable-read-api` flag at the command line to opt in to these
  endpoints.

# v0.20.1 (2021-12-08)

*NOTE*: The fixes in this patch are only present in v0.20.1 and >=v0.21.2.

- [SECURITY] This release contains a fix for
  [CVE-2021-41090](https://github.com/grafana/agent/security/advisories/GHSA-9c4x-5hgq-q3wh).

- [CHANGE] This release disables the existing `/-/config` and
  `/agent/api/v1/configs/{name}` endpoitns by default. Pass the
  `--config.enable-read-api` flag at the command line to opt in to these
  endpoints.

  grafana/agent:v0.21.2 \
  - image: grafana/agent:v0.21.2
  grafana/agent:v0.21.2 \
  - image: grafana/agent:v0.21.2
  grafana/agent:v0.21.2
  image: grafana/agent:v0.21.2
        image: grafana/agent-operator:v0.21.2
## v0.21.2, v0.20.1

### Disabling of config retrieval enpoints

These two patch releases, as part of a fix for
[CVE-2021-41090](https://github.com/grafana/agent/security/advisories/GHSA-9c4x-5hgq-q3wh),
disable the `/-/config` and `/agent/api/v1/configs/{name}` endpoints by
default. Pass the `--config.enable-read-api` flag at the command line to
re-enable them.

		"v0.20.1",
		"v0.21.2",
  grafana/agent:v0.21.2
RELEASE_VERSION="0.21.2"
        image: grafana/agent:v0.21.2
        image: grafana/agent:v0.21.2
        image: grafana/agent:v0.21.2
'grafana/agent:v0.21.2'
MANIFEST_BRANCH=v0.21.2
    agent: 'grafana/agent:v0.21.2',
    agentctl: 'grafana/agentctl:v0.21.2',
    agent: 'grafana/agent:v0.21.2',
    agentctl: 'grafana/agentctl:v0.21.2',
    image: 'grafana/agentctl:v0.21.2',