Tóm tắt nhanh
- CVE-2024-56323 là lỗ hổng mức NGHIÊM TRỌNG (CVSS 9.8) ảnh hưởng github.com/openfga/openfga, helm charts (openfga), openfga (openfga).
- Xác suất bị khai thác trong 30 ngày tới (EPSS): 0.44%, cao hơn 38.4% các lỗ hổng khác.
- Cách xử lý: cập nhật lên 1.8.3, 0.2.19 hoặc mới hơn.
Mô tả
Overview
OpenFGA v1.3.8 to v1.8.2 (Helm chart openfga-0.1.38 to openfga-0.2.19, docker v1.3.8 to v.1.8.2) are vulnerable to authorization bypass when certain Check and ListObject calls are executed.
Am I Affected?
You are affected by this authorization bypass vulnerability if you are using OpenFGA v1.3.8 to v1.8.2, specifically under the following conditions:
- Calling Check API or ListObjects with a model that uses conditions, and
- OpenFGA is configured with caching enabled (
OPENFGA_CHECK_QUERY_CACHE_ENABLED), and
- Check API call or ListObjects API calls contain contextual tuples that include conditions.
Fix
Upgrade to v1.8.3. This upgrade is backwards compatible.
Mô tả của NVD
OpenFGA is an authorization/permission engine. IN OpenFGA v1.3.8 to v1.8.2 (Helm chart openfga-0.1.38 to openfga-0.2.19, docker v1.3.8 to v.1.8.2) are vulnerable to authorization bypass under the following conditions: 1. calling Check API or ListObjects with a model that uses [conditions](https://openfga.dev/docs/modeling/conditions), and 2. calling Check API or ListObjects API with [contextual tuples](https://openfga.dev/docs/concepts#what-are-contextual-tuples) that include conditions and 3. OpenFGA is configured with caching enabled (`OPENFGA_CHECK_QUERY_CACHE_ENABLED`). Users are advised to upgrade to v1.8.3. There are no known workarounds for this vulnerability.
Bạn đang dùng một trong các sản phẩm này? Quét site để biết có đang lộ phiên bản có lỗ hổng không.
Quét site miễn phí