GHSA-m54h-5x5f-5m6r

Source

https://github.com/advisories/GHSA-m54h-5x5f-5m6r

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/06/GHSA-m54h-5x5f-5m6r/GHSA-m54h-5x5f-5m6r.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-m54h-5x5f-5m6r

Aliases

Published

2023-06-28T22:48:50Z

Modified

2024-08-20T20:58:43.101918Z

Severity

3.7 (Low) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N CVSS Calculator

Summary

SpiceDB's LookupResources may return partial results

Details

Impact

Any user making a negative authorization decision based on the results of a LookupResources request with 1.22.0 is affected.

For example, using LookupResources to find a list of resources to allow access to be okay: some subjects that should have access to a resource may not. But if using LookupResources to find a list of banned resources instead, then some users that shouldn't have access may.

Generally, LookupResources is not and should not be used to gate access in this way - that's what the Check API is for. Additionally, version 1.22.0 has included a warning about this bug since its initial release.

Workarounds

Avoid using LookupResources for negative authorization decisions if using 1.22.0.

Patches

The only affected release is v1.22.0, and it is patched in v1.22.2 (there is no v1.22.1 release, though there is a git tag).

References

https://github.com/authzed/spicedb/pull/1397

For more information

If you have any questions or comments about this advisory: * Open an issue in SpiceDB * Ask a question in the SpiceDB Discord

Database specific

{
    "nvd_published_at": "2023-06-26T20:15:10Z",
    "cwe_ids": [
        "CWE-913"
    ],
    "severity": "LOW",
    "github_reviewed": true,
    "github_reviewed_at": "2023-06-28T22:48:50Z"
}

GHSA-m54h-5x5f-5m6r

Impact

Workarounds

Patches

References

For more information

Affected packages

Go / github.com/authzed/spicedb

Package

Affected ranges

Affected versions

1.*