GHSA-chqx-36rm-rf8h

Grafana Alloy on Windows has Unquoted Search Path or Element vulnerability

Source: GitHub Advisory Database (reviewed) Moderate CVE-2024-8975

Packages

Ecosystem	Package	Affected	Fixed in
Go	github.com/grafana/alloy	< 1.3.4	1.3.4
Go	github.com/grafana/alloy	>= 1.4.0-rc.0, < 1.4.1	1.4.1

Details

As written in the advisory (Markdown source, shown as plain text).

Unquoted Search Path or Element vulnerability in Grafana Alloy on Windows allows Privilege Escalation from Local User to SYSTEM. This issue affects Alloy: before 1.3.4, from 1.4.0-rc.0 and prior to 1.4.1.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2024-8975 advisory
https://github.com/grafana/alloy/commit/88e779887690954c009503598a3f4bf563cb6596 web
https://github.com/grafana/alloy/commit/f14249012fd970d3fd73604e6fff9b6c7990a9bb web
https://github.com/grafana/alloy package
https://github.com/grafana/alloy/releases/tag/v1.3.4 web
https://github.com/grafana/alloy/releases/tag/v1.4.0 web
https://github.com/grafana/alloy/releases/tag/v1.4.1 web
https://grafana.com/blog/2024/09/25/grafana-alloy-and-grafana-agent-flow-security-release-high-severity-fix-for-cve-2024-8975-and-cve-2024-8… web
https://grafana.com/security/security-advisories/cve-2024-8975 web
https://pkg.go.dev/vuln/GO-2024-3168 web