Em resumo
- CVE-2024-23820 é uma vulnerabilidade MÉDIO (CVSS 6.5) que afeta github.com/openfga/openfga, openfga (openfga).
- Chance de exploração nos próximos 30 dias (EPSS): 0.73%, maior que 54.4% das vulnerabilidades.
- Correção: atualize para 1.4.3 ou posterior.
Description
Overview
OpenFGA is vulnerable to a DoS attack. In some scenarios that depend on the model and tuples used, a call to ListObjects may not release memory properly. So when a sufficiently high number of those calls are executed, the OpenFGA server can create an "out of memory" error and terminate.
Fix
Upgrade to v1.4.3. This upgrade is backwards compatible.
NVD description
OpenFGA, an authorization/permission engine, is vulnerable to a denial of service attack in versions prior to 1.4.3. In some scenarios that depend on the model and tuples used, a call to `ListObjects` may not release memory properly. So when a sufficiently high number of those calls are executed, the OpenFGA server can create an `out of memory` error and terminate. Version 1.4.3 contains a patch for this issue.
Mais vulnerabilidades de github.com/openfga/openfga
Ver tudo →Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free