PT-2024-20102 · Openfga · Openfga

Miparnisari · Published 2024-01-26 · Updated 2024-06-28 · CVE-2024-23820

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions OpenFGA versions prior to 1.4.3

Description OpenFGA, an authorization/permission engine, is vulnerable to a denial of service attack. In some scenarios that depend on the model and tuples used, a call to ListObjects may not release memory properly. When a sufficiently high number of those calls are executed, the OpenFGA server can create an "out of memory" error and terminate.

Recommendations Upgrade to version 1.4.3, as this upgrade is backwards compatible and contains a patch for the issue. As a temporary workaround, consider restricting the number of calls to ListObjects to minimize the risk of exploitation.

Exploit

Fix

Memory Leak

Allocation of Resources Without Limits

Weakness Enumeration

CWE-401

CWE-770

Related Identifiers

CVE-2024-23820

GHSA-RXPW-85VW-FX87

GO-2024-2477

Affected Products

Openfga

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/23xxx/CVE-2024-23820.json · Exploit
• https://github.com/openfga/openfga/commit/908ac85c8b7769c8042cca31886df8db01976c39 · Patch
• https://osv.dev/vulnerability/GHSA-rxpw-85vw-fx87 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2024-2477 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-23820 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-23820 · Security Note
• https://github.com/openfga/openfga · Note
• https://github.com/openfga/openfga/security/advisories/GHSA-rxpw-85vw-fx87 · Note
• https://github.com/openfga/openfga/releases/tag/v1.4.3 · Note
• https://twitter.com/CVEnew/status/1750924714179240322 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1750968046309581300 · Twitter Post