PT-2022-19324 · Unknown · Open Policy Agent

Norbert Szetei · Published 2022-05-19 · Updated 2024-06-15 · CVE-2022-28946

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Open Policy Agent version 0.39.0

Description The issue is caused by a problem in the ast/parser.go component of Open Policy Agent, which leads to incorrect interpretation of expressions. This results in a Denial of Service (DoS) due to out-of-range memory access.

Recommendations For Open Policy Agent version 0.39.0, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

CVE-2022-28946

GHSA-X7F3-62PM-9P38

GO-2022-0587

OPENSUSE-SU-2022:10022-1

OPENSUSE-SU-2022:10094-1

OPENSUSE-SU-2024:12102-1

OPENSUSE-SU-2024:12128-1

Affected Products

Open Policy Agent

References · 19

• https://github.com/open-policy-agent/opa/commit/e9d3828db670cbe11129885f37f08cbf04935264 · Patch
• https://osv.dev/vulnerability/openSUSE-SU-2024:12102-1 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:12128-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-28946 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2022:10094-1 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-x7f3-62pm-9p38 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-28946 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2022:10022-1 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2022-0587 · Vendor Advisory
• https://github.com/open-policy-agent/opa · Note
• https://github.com/open-policy-agent/opa/pull/4548 · Note
• https://lists.opensuse.org/archives/list/[e-mail]/thread/43ATI5PP2NX5LEC336CTPYZBZIQPNK2B · Note
• https://bugzilla.suse.com/1199760 · Note
• https://lists.opensuse.org/archives/list/[e-mail]/thread/TFXT5GO737TPBRXIUOZS7A3WOJKWSJAX · Note
• https://suse.com/security/cve/CVE-2022-23648 · Note