Tóm tắt nhanh
- CVE-2024-32001 là lỗ hổng mức TRUNG BÌNH (CVSS 4.3) ảnh hưởng github.com/authzed/spicedb, spicedb (authzed).
- Xác suất bị khai thác trong 30 ngày tới (EPSS): 0.58%, cao hơn 47.6% các lỗ hổng khác.
- Cách xử lý: cập nhật lên 1.30.1 hoặc mới hơn.
Mô tả
Background
Use of a relation of the form: relation folder: folder | folder#parent with an arrow such as folder->view can cause LookupSubjects to only return the subjects found under subjects for either folder or folder#parent.
This bug only manifests if the same subject type is used multiple types in a relation, relationships exist for both subject types and an arrow is used over the relation.
Impact
Any user making a negative authorization decision based on the results of a LookupSubjects request with version before v1.30.1 is affected.
Workarounds
Avoid using LookupSubjects for negative authorization decisions and/or avoid using the broken schema.
Mô tả của NVD
SpiceDB is a graph database purpose-built for storing and evaluating access control data. Use of a relation of the form: `relation folder: folder | folder#parent` with an arrow such as `folder->view` can cause LookupSubjects to only return the subjects found under subjects for either `folder` or `folder#parent`. This bug only manifests if the same subject type is used multiple types in a relation, relationships exist for both subject types and an arrow is used over the relation. Any user making a negative authorization decision based on the results of a LookupSubjects request with version before v1.30.1 is affected. Version 1.30.1 contains a patch for the issue. As a workaround, avoid using LookupSubjects for negative authorization decisions and/or avoid using the broken schema.
Bạn đang dùng một trong các sản phẩm này? Quét site để biết có đang lộ phiên bản có lỗ hổng không.
Quét site miễn phí