OpenFGA DoS vulnerability

高 7.5CVE-2023-45810 · GHSA-hr4f-6jh8-f2vq · GO-2023-2121 · 17/10/2023 公開 · 17/06/2026 更新

要点

CVE-2023-45810 は github.com/openfga/openfga, openfga (openfga) に影響する深刻度「高」 (CVSS 7.5) の脆弱性です。
今後30日間に悪用される確率（EPSS）：0.61%（全脆弱性の 49.1% より高い）。
対処：1.3.4 以降に更新してください。

パッケージ	影響を受けるバージョン	修正済みバージョン
github.com/openfga/openfga Go	`< 1.3.4`	`1.3.4`
openfga openfga	`< 1.3.4`	`1.3.4`

概要

Overview

OpenFGA is vulnerable to a DoS attack. When a number of ListObjects calls are executed, in some scenarios, those calls are not releasing resources even after a response has been sent, and the service as a whole becomes unresponsive.

Fix

Upgrade to v1.3.4. This upgrade is backwards compatible.

NVD の説明

OpenFGA is a flexible authorization/permission engine built for developers and inspired by Google Zanzibar. Affected versions of OpenFGA are vulnerable to a denial of service attack. When a number of `ListObjects` calls are executed, in some scenarios, those calls are not releasing resources even after a response has been sent, and given a sufficient call volume the service as a whole becomes unresponsive. This issue has been addressed in version 1.3.4 and the upgrade is considered backwards compatible. There are no known workarounds for this vulnerability.