PT-2023-29700 · Openfga · Openfga

Klausvii · Publicado 2023-10-17 · Atualizado 2024-08-21 · CVE-2023-45810

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Média

Vetor base

AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions OpenFGA versions prior to 1.3.4

Description OpenFGA is a flexible authorization/permission engine built for developers and inspired by Google Zanzibar. Affected versions of OpenFGA are vulnerable to a denial of service attack. When a number of ListObjects calls are executed, in some scenarios, those calls are not releasing resources even after a response has been sent, and given a sufficient call volume the service as a whole becomes unresponsive.

Recommendations Upgrade to version 1.3.4, as this upgrade is backwards compatible and addresses the issue. There are no known workarounds for this vulnerability.

Exploit

Correção

Resource Exhaustion

Enumeração de Fraquezas

CWE-400

Identificadores relacionados

CVE-2023-45810

GHSA-HR4F-6JH8-F2VQ

GO-2023-2121

Produtos afetados

Openfga

Referências · 13

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/45xxx/CVE-2023-45810.json · Exploit
• https://github.com/openfga/openfga · Nota
• https://github.com/openfga/openfga/releases/tag/v1.3.4 · Nota
• https://github.com/openfga/openfga/security/advisories/GHSA-hr4f-6jh8-f2vq · Nota
• https://twitter.com/CVEnew/status/1714411126283530447 · Publicação no Twitter
• https://twitter.com/VulmonFeeds/status/1714437922533863567 · Publicação no Twitter
• https://osv.dev/vulnerability/GHSA-hr4f-6jh8-f2vq · Aviso do Fabricante
• https://t.me/cvenotify/59632 · Publicação no Telegram
• https://t.me/cvenotify/59942 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2023-45810 · Aviso do Fabricante
• https://t.me/cibsecurity/72457 · Publicação no Telegram
• https://osv.dev/vulnerability/GO-2023-2121 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-45810 · Nota de Segurança