Kurz gesagt
- CVE-2023-45810 ist eine Schwachstelle (HOCH (CVSS 7.5)) in github.com/openfga/openfga, openfga (openfga).
- Wahrscheinlichkeit einer Ausnutzung in den nächsten 30 Tagen (EPSS): 0.61%, höher als bei 49.1% aller Schwachstellen.
- Abhilfe: auf 1.3.4 oder neuer aktualisieren.
Description
Overview
OpenFGA is vulnerable to a DoS attack. When a number of ListObjects calls are executed, in some scenarios, those calls are not releasing resources even after a response has been sent, and the service as a whole becomes unresponsive.
Fix
Upgrade to v1.3.4. This upgrade is backwards compatible.
NVD description
OpenFGA is a flexible authorization/permission engine built for developers and inspired by Google Zanzibar. Affected versions of OpenFGA are vulnerable to a denial of service attack. When a number of `ListObjects` calls are executed, in some scenarios, those calls are not releasing resources even after a response has been sent, and given a sufficient call volume the service as a whole becomes unresponsive. This issue has been addressed in version 1.3.4 and the upgrade is considered backwards compatible. There are no known workarounds for this vulnerability.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free