CVE-2021-41090 (published 2021-12-08T17:15Z)

Grafana Agent is a telemetry collector for sending metrics, logs, and trace data to the opinionated Grafana observability stack. Prior to versions 0.20.1 and 0.21.2, inline secrets defined within a metrics instance config are exposed in plaintext over two endpoints: metrics instance configs defined in the base YAML file are exposed at `/-/config` and metrics instance configs defined for the scraping service are exposed at `/agent/api/v1/configs/:key`. Inline secrets will be exposed to anyone being able to reach these endpoints. If HTTPS with client authentication is not configured, these endpoints are accessible to unauthenticated users. Secrets found in these sections are used for delivering metrics to a Prometheus Remote Write system, authenticating against a system for discovering Prometheus targets, and authenticating against a system for collecting metrics. This does not apply for non-inlined secrets, such as `*_file` based secrets. This issue is patched in Grafana Agent versions 0.20.1 and 0.21.2. A few workarounds are available. Users who cannot upgrade should use non-inline secrets where possible. Users may also desire to restrict API access to Grafana Agent with some combination of restricting the network interfaces Grafana Agent listens on through `http_listen_address` in the `server` block, configuring Grafana Agent to use HTTPS with client authentication, and/or using firewall rules to restrict external access to Grafana Agent's API.

Severity: MEDIUM
CVSS v2 base score: 4.3 (AV:N/AC:M/Au:N/C:P/I:N/A:N)
CVSS v3 base score: 7.5, HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)

Weakness information:
cwe_id: CWE-312
cwe_name: Cleartext Storage of Sensitive Information
description: The product stores sensitive information in cleartext within a resource that might be accessible to another control sphere.
extended_description: 
	 Because the information is stored in cleartext (i.e., unencrypted), attackers could potentially read it. Even if the information is encoded in a way that is not human-readable, certain techniques could determine which encoding is being used, then decode the information.
	 When organizations adopt cloud services, it can be easier for attackers to access the data from anywhere on the Internet.
	 In some systems/environments such as cloud, the use of "double encryption" (at both the software and hardware layer) might be required, and the developer might be solely responsible for both layers, instead of shared responsibility with the administrator of the broader system/environment.
       
         

Fix information:
repo_url: https://github.com/grafana/agent
commit_details: repo_url: https://github.com/grafana/agent
author: Robert Fratto
author_date: 2021-12-08 08:40:17-05:00
msg: announce patch releases for cve-2021-41090 (#1152)
repository: repo_url: https://github.com/grafana/agent
repo_name: grafana/agent
description: Vendor-neutral programmable observability pipelines.
repo_language: Go
owner: grafana
file_changes: filename: CHANGELOG.md
change_type: ModificationType.MODIFY
diff: @@ -5,6 +5,16 @@
 
 - [ENHANCEMENT] Traces: Improved pod association in PromSD processor (@mapno)
 
+# v0.21.2 (2021-12-08)
+
+- [SECURITY] This release contains a fix for
+  [CVE-2021-41090](https://github.com/grafana/agent/security/advisories/GHSA-9c4x-5hgq-q3wh).
+
+- [CHANGE] This release disables the existing `/-/config` and
+  `/agent/api/v1/configs/{name}` endpoitns by default. Pass the
+  `--config.enable-read-api` flag at the command line to opt in to these
+  endpoints.
+
 # v0.21.1 (2021-11-18)
 
 - [BUGFIX] Fix panic when using postgres_exporter integration (@saputradharma)
@@ -47,6 +57,18 @@
 
 - [CHANGE] Traces: Changed service graphs store implementation to improve CPU performance (@mapno)
 
+# v0.20.1 (2021-12-08)
+
+*NOTE*: The fixes in this patch are only present in v0.20.1 and >=v0.21.2.
+
+- [SECURITY] This release contains a fix for
+  [CVE-2021-41090](https://github.com/grafana/agent/security/advisories/GHSA-9c4x-5hgq-q3wh).
+
+- [CHANGE] This release disables the existing `/-/config` and
+  `/agent/api/v1/configs/{name}` endpoitns by default. Pass the
+  `--config.enable-read-api` flag at the command line to opt in to these
+  endpoints.
+
 # v0.20.0 (2021-10-28)
 
 - [FEATURE] Operator: The Grafana Agent Operator can now generate a Kubelet

programming_language: Markdown
filename: node-exporter-config.md
change_type: ModificationType.MODIFY
diff: @@ -26,7 +26,7 @@ docker run \
   -v "/proc:/host/proc:ro,rslave" \
   -v /tmp/agent:/etc/agent \
   -v /path/to/config.yaml:/etc/agent-config/agent.yaml \
-  grafana/agent:v0.21.1 \
+  grafana/agent:v0.21.2 \
   --config.file=/etc/agent-config/agent.yaml
 ```
 
@@ -66,7 +66,7 @@ metadata:
   name: agent
 spec:
   containers:
-  - image: grafana/agent:v0.21.1
+  - image: grafana/agent:v0.21.2
     name: agent
     args:
     - --config.file=/etc/agent-config/agent.yaml

programming_language: Markdown
filename: process-exporter-config.md
change_type: ModificationType.MODIFY
diff: @@ -18,7 +18,7 @@ docker run \
   -v "/proc:/proc:ro" \
   -v /tmp/agent:/etc/agent \
   -v /path/to/config.yaml:/etc/agent-config/agent.yaml \
-  grafana/agent:v0.21.1 \
+  grafana/agent:v0.21.2 \
   --config.file=/etc/agent-config/agent.yaml
 ```
 
@@ -35,7 +35,7 @@ metadata:
   name: agent
 spec:
   containers:
-  - image: grafana/agent:v0.21.1
+  - image: grafana/agent:v0.21.2
     name: agent
     args:
     - --config.file=/etc/agent-config/agent.yaml

programming_language: Markdown
filename: _index.md
change_type: ModificationType.MODIFY
diff: @@ -26,7 +26,7 @@ See the list of [Community Projects](#community-projects) for the community-driv
 docker run \
   -v /tmp/agent:/etc/agent/data \
   -v /path/to/config.yaml:/etc/agent/agent.yaml \
-  grafana/agent:v0.21.1
+  grafana/agent:v0.21.2
 ```
 
 Replace `/tmp/agent` with the folder you wish to store WAL data in. WAL data is

programming_language: Markdown
filename: custom-resource-quickstart.md
change_type: ModificationType.MODIFY
diff: @@ -43,7 +43,7 @@ metadata:
   labels:
     app: grafana-agent
 spec:
-  image: grafana/agent:v0.21.1
+  image: grafana/agent:v0.21.2
   logLevel: info
   serviceAccountName: grafana-agent
   metrics:

programming_language: Markdown
filename: getting-started.md
change_type: ModificationType.MODIFY
diff: @@ -72,7 +72,7 @@ spec:
       serviceAccountName: grafana-agent-operator
       containers:
       - name: operator
-        image: grafana/agent-operator:v0.21.1
+        image: grafana/agent-operator:v0.21.2
         args:
         - --kubelet-service=default/kubelet
 ---

programming_language: Markdown
filename: _index.md
change_type: ModificationType.MODIFY
diff: @@ -12,6 +12,16 @@ releases and how to migrate to newer versions.
 
 These changes will come in a future version.
 
+## v0.21.2, v0.20.1
+
+### Disabling of config retrieval enpoints
+
+These two patch releases, as part of a fix for
+[CVE-2021-41090](https://github.com/grafana/agent/security/advisories/GHSA-9c4x-5hgq-q3wh),
+disable the `/-/config` and `/agent/api/v1/configs/{name}` endpoints by
+default. Pass the `--config.enable-read-api` flag at the command line to
+re-enable them.
+
 ## v0.21.0
 
 ### Integrations: Change in how instance labels are handled (Breaking change)

programming_language: Markdown
filename: defaults.go
change_type: ModificationType.MODIFY
diff: @@ -15,8 +15,10 @@ var (
 		"v0.18.4",
 		"v0.19.0",
 		"v0.20.0",
+		"v0.20.1",
 		"v0.21.0",
 		"v0.21.1",
+		"v0.21.2",
 
 		// NOTE(rfratto): when performing an upgrade, add the newest version above instead of changing the existing reference.
 	}

programming_language: Go
filename: README.md
change_type: ModificationType.MODIFY
diff: @@ -27,7 +27,7 @@ directory on your host that you want the agent to store its WAL.
 docker run \
   -v /tmp/agent:/etc/agent/data \
   -v /path/to/config.yaml:/etc/agent/agent.yaml \
-  grafana/agent:v0.21.1
+  grafana/agent:v0.21.2
 ```
 
 ## Running the Agent locally

programming_language: Markdown
filename: grafanacloud-install.sh
change_type: ModificationType.MODIFY
diff: @@ -50,7 +50,7 @@ PACKAGE_SYSTEM=${PACKAGE_SYSTEM:=}
 #
 # Global constants.
 #
-RELEASE_VERSION="0.21.1"
+RELEASE_VERSION="0.21.2"
 
 RELEASE_URL="https://github.com/grafana/agent/releases/download/v${RELEASE_VERSION}"
 DEB_URL="${RELEASE_URL}/grafana-agent-${RELEASE_VERSION}-1.${ARCH}.deb"

programming_language: Shell
filename: agent-bare.yaml
change_type: ModificationType.MODIFY
diff: @@ -66,7 +66,7 @@ spec:
           valueFrom:
             fieldRef:
               fieldPath: spec.nodeName
-        image: grafana/agent:v0.21.1
+        image: grafana/agent:v0.21.2
         imagePullPolicy: IfNotPresent
         name: agent
         ports:

programming_language: Markdown
filename: agent-loki.yaml
change_type: ModificationType.MODIFY
diff: @@ -64,7 +64,7 @@ spec:
           valueFrom:
             fieldRef:
               fieldPath: spec.nodeName
-        image: grafana/agent:v0.21.1
+        image: grafana/agent:v0.21.2
         imagePullPolicy: IfNotPresent
         name: agent
         ports:

programming_language: CoffeeScript
filename: agent-traces.yaml
change_type: ModificationType.MODIFY
diff: @@ -109,7 +109,7 @@ spec:
           valueFrom:
             fieldRef:
               fieldPath: spec.nodeName
-        image: grafana/agent:v0.21.1
+        image: grafana/agent:v0.21.2
         imagePullPolicy: IfNotPresent
         name: agent
         ports:

programming_language: CoffeeScript
filename: version.libsonnet
change_type: ModificationType.MODIFY
diff: @@ -1 +1 @@
-'grafana/agent:v0.21.1'
+'grafana/agent:v0.21.2'

programming_language: SQL
filename: install-bare.sh
change_type: ModificationType.MODIFY
diff: @@ -25,7 +25,7 @@ check_installed() {
 check_installed curl
 check_installed envsubst
 
-MANIFEST_BRANCH=v0.21.1
+MANIFEST_BRANCH=v0.21.2
 MANIFEST_URL=${MANIFEST_URL:-https://raw.githubusercontent.com/grafana/agent/${MANIFEST_BRANCH}/production/kubernetes/agent-bare.yaml}
 NAMESPACE=${NAMESPACE:-default}
 

programming_language: Shell
filename: main.libsonnet
change_type: ModificationType.MODIFY
diff: @@ -15,8 +15,8 @@ local service = k.core.v1.service;
 (import './lib/traces.libsonnet') +
 {
   _images:: {
-    agent: 'grafana/agent:v0.21.1',
-    agentctl: 'grafana/agentctl:v0.21.1',
+    agent: 'grafana/agent:v0.21.2',
+    agentctl: 'grafana/agentctl:v0.21.2',
   },
 
   // new creates a new DaemonSet deployment of the grafana-agent. By default,

programming_language: JavaScript
filename: base.libsonnet
change_type: ModificationType.MODIFY
diff: @@ -10,8 +10,8 @@ function(name='grafana-agent', namespace='') {
   local this = self,
 
   _images:: {
-    agent: 'grafana/agent:v0.21.1',
-    agentctl: 'grafana/agentctl:v0.21.1',
+    agent: 'grafana/agent:v0.21.2',
+    agentctl: 'grafana/agentctl:v0.21.2',
   },
   _config:: {
     name: name,

programming_language: JavaScript
filename: syncer.libsonnet
change_type: ModificationType.MODIFY
diff: @@ -14,7 +14,7 @@ function(
 ) {
   local _config = {
     api: error 'api must be set',
-    image: 'grafana/agentctl:v0.21.1',
+    image: 'grafana/agentctl:v0.21.2',
     schedule: '*/5 * * * *',
     configs: [],
   } + config,

programming_language: Lua