PT-2024-33261 · Spicedb+1 · Spicedb+1

Vroldanbet · CVE-2024-48909 · Published 2024-10-14 · Updated 2024-11-05

Positive Technologies (AI Summary)

CVSS v3.1

2.4

Low

Base vector

AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions SpiceDB versions 1.35.0 through 1.37.0

Description SpiceDB is an open source database for scalably storing and querying fine-grained authorization data. Clients that have enabled LookupResources2 and have caveats in the evaluation path for their requests can return a permissionship of CONDITIONAL with context marked as missing, even when the context was supplied. This issue occurs because LookupResources2 is the new default in SpiceDB 1.37.0 and has been opt-in since SpiceDB 1.35.0.

Recommendations For SpiceDB versions 1.35.0 through 1.37.0, disable LookupResources2 via the --enable-experimental-lookup-resources flag by setting it to false. For SpiceDB versions prior to 1.37.1, update to SpiceDB 1.37.1 to resolve the issue.

Exploit

Fix

Weakness Enumeration

CWE-172

Related Identifiers

CVE-2024-48909

GHSA-3C32-4HQ9-6WGJ

GO-2024-3200

OPENSUSE-SU-2024:0350-1

OPENSUSE-SU-2024:14447-1

OPENSUSE-SU-2024_3911-1

SUSE-SU-2024:3911-1

Affected Products

Spicedb

Suse

References · 75

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/48xxx/CVE-2024-48909.json · Exploit
• https://github.com/authzed/spicedb/commit/2f3cf77a7fcfcb478ef5a480a245842c96ac8853 · Patch
• https://osv.dev/vulnerability/openSUSE-SU-2024:0350-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-48909 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-48909 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2024:3911-1 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2024-3200 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-3c32-4hq9-6wgj · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:14447-1 · Vendor Advisory
• https://github.com/authzed/spicedb · Note
• https://github.com/authzed/spicedb/security/advisories/GHSA-3c32-4hq9-6wgj · Note
• https://suse.com/security/cve/CVE-2024-8038 · Note
• https://suse.com/security/cve/CVE-2024-48921 · Note
• https://suse.com/security/cve/CVE-2024-39223 · Note
• https://suse.com/security/cve/CVE-2024-0133 · Note