En resumen
- CVE-2024-23820 es una vulnerabilidad MEDIO (CVSS 6.5) que afecta a github.com/openfga/openfga, openfga (openfga).
- Probabilidad de explotación en los próximos 30 días (EPSS): 0.73%, mayor que el 54.4% de las vulnerabilidades.
- Solución: actualizar a 1.4.3 o posterior.
Description
Overview
OpenFGA is vulnerable to a DoS attack. In some scenarios that depend on the model and tuples used, a call to ListObjects may not release memory properly. So when a sufficiently high number of those calls are executed, the OpenFGA server can create an "out of memory" error and terminate.
Fix
Upgrade to v1.4.3. This upgrade is backwards compatible.
NVD description
OpenFGA, an authorization/permission engine, is vulnerable to a denial of service attack in versions prior to 1.4.3. In some scenarios that depend on the model and tuples used, a call to `ListObjects` may not release memory properly. So when a sufficiently high number of those calls are executed, the OpenFGA server can create an `out of memory` error and terminate. Version 1.4.3 contains a patch for this issue.
Más vulnerabilidades de github.com/openfga/openfga
Ver todo →Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free