En bref
- CVE-2024-23820 est une vulnérabilité MOYENNE (CVSS 6.5) touchant github.com/openfga/openfga, openfga (openfga).
- Probabilité d'exploitation dans les 30 prochains jours (EPSS) : 0.73%, plus élevée que 54.4% des vulnérabilités.
- Correctif : mettre à jour vers 1.4.3 ou plus récent.
Description
Overview
OpenFGA is vulnerable to a DoS attack. In some scenarios that depend on the model and tuples used, a call to ListObjects may not release memory properly. So when a sufficiently high number of those calls are executed, the OpenFGA server can create an "out of memory" error and terminate.
Fix
Upgrade to v1.4.3. This upgrade is backwards compatible.
NVD description
OpenFGA, an authorization/permission engine, is vulnerable to a denial of service attack in versions prior to 1.4.3. In some scenarios that depend on the model and tuples used, a call to `ListObjects` may not release memory properly. So when a sufficiently high number of those calls are executed, the OpenFGA server can create an `out of memory` error and terminate. Version 1.4.3 contains a patch for this issue.
Autres vulnérabilités de github.com/openfga/openfga
Tout voir →Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free