Kurz gesagt
- CVE-2024-23820 ist eine Schwachstelle (MITTEL (CVSS 6.5)) in github.com/openfga/openfga, openfga (openfga).
- Wahrscheinlichkeit einer Ausnutzung in den nächsten 30 Tagen (EPSS): 0.73%, höher als bei 54.4% aller Schwachstellen.
- Abhilfe: auf 1.4.3 oder neuer aktualisieren.
Description
Overview
OpenFGA is vulnerable to a DoS attack. In some scenarios that depend on the model and tuples used, a call to ListObjects may not release memory properly. So when a sufficiently high number of those calls are executed, the OpenFGA server can create an "out of memory" error and terminate.
Fix
Upgrade to v1.4.3. This upgrade is backwards compatible.
NVD description
OpenFGA, an authorization/permission engine, is vulnerable to a denial of service attack in versions prior to 1.4.3. In some scenarios that depend on the model and tuples used, a call to `ListObjects` may not release memory properly. So when a sufficiently high number of those calls are executed, the OpenFGA server can create an `out of memory` error and terminate. Version 1.4.3 contains a patch for this issue.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free