PT-2023-25388 · Spicedb · Spicedb

Lowecordell · Published 2023-06-26 · Updated 2024-08-20 · CVE-2023-35930

Positive Technologies (AI Summary)

CVSS v3.1

3.7

Low

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions SpiceDB version 1.22.0

Description The issue affects users making negative authorization decisions based on the results of a LookupResources request. This can lead to incorrect access control, where some subjects may not have access to resources they should, or some users may have access to resources they should not. The LookupResources function is not intended for gating access and should be used in conjunction with the Check API. Version 1.22.0 includes a warning about this bug. Users are advised to upgrade to version 1.22.2 to resolve the issue.

Recommendations For SpiceDB version 1.22.0, upgrade to version 1.22.2 to resolve the issue. If unable to upgrade, avoid using LookupResources for negative authorization decisions as a temporary workaround.

Exploit

Fix

Weakness Enumeration

CWE-913

Related Identifiers

CVE-2023-35930

GHSA-M54H-5X5F-5M6R

GO-2023-1871

Affected Products

Spicedb

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/35xxx/CVE-2023-35930.json · Exploit
• https://github.com/authzed/spicedb/security/advisories/GHSA-m54h-5x5f-5m6r · Vendor Advisory
• https://github.com/authzed/spicedb/pull/1397 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-35930 · Security Note
• https://osv.dev/vulnerability/CVE-2023-35930 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2023-1871 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-m54h-5x5f-5m6r · Vendor Advisory
• https://github.com/authzed/spicedb · Note
• https://github.com/authzed/spicedb/releases/tag/v1.22.2 · Note
• https://t.me/cvenotify/53052 · Telegram Post