PT-2023-29700 · Openfga · Openfga

Klausvii · Published 2023-10-17 · Updated 2024-08-21 · CVE-2023-45810

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions OpenFGA versions prior to 1.3.4

Description OpenFGA is a flexible authorization/permission engine built for developers and inspired by Google Zanzibar. Affected versions of OpenFGA are vulnerable to a denial of service attack. When a number of ListObjects calls are executed, in some scenarios, those calls are not releasing resources even after a response has been sent, and given a sufficient call volume the service as a whole becomes unresponsive.

Recommendations Upgrade to version 1.3.4, as this upgrade is backwards compatible and addresses the issue. There are no known workarounds for this vulnerability.

Exploit

Fix

Resource Exhaustion

Weakness Enumeration

CWE-400

Related Identifiers

CVE-2023-45810

GHSA-HR4F-6JH8-F2VQ

GO-2023-2121

Affected Products

Openfga

References · 13

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/45xxx/CVE-2023-45810.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2023-45810 · Security Note
• https://osv.dev/vulnerability/CVE-2023-45810 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2023-2121 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-hr4f-6jh8-f2vq · Vendor Advisory
• https://github.com/openfga/openfga · Note
• https://github.com/openfga/openfga/security/advisories/GHSA-hr4f-6jh8-f2vq · Note
• https://github.com/openfga/openfga/releases/tag/v1.3.4 · Note
• https://twitter.com/VulmonFeeds/status/1714437922533863567 · Twitter Post
• https://t.me/cibsecurity/72457 · Telegram Post
• https://t.me/cvenotify/59942 · Telegram Post
• https://twitter.com/CVEnew/status/1714411126283530447 · Twitter Post
• https://t.me/cvenotify/59632 · Telegram Post