CVE-2024-46989: falha de baixa gravidade em authzed spicedb
Multiple caveats on resources of the same type can result in no permission when permission is expected
Publicada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
8Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 3.7epss 0.3%
spicedb is an Open Source, Google Zanzibar-inspired permissions database to enable fine-grained authorization for customer applications. Multiple caveats over the same indirect subject type on the same relation can result in no permission being returned when permission is expected. If the resource has multiple groups, and each group is caveated, it is possible for the returned permission to be "no permission" when permission is expected. Permission is returned as NO_PERMISSION when PERMISSION is expected on the CheckPermission API. This issue has been addressed in release version 1.35.3. Users are advised to upgrade. Users unable to upgrade should not use caveats or avoid the use of caveats on an indirect subject type with multiple entries.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
Produtos afetados
authzed · spicedbCVEs relacionadas — authzed spicedb
No mesmo produto, das mais perigosas para as menos.
CVE-2022-21646HIGHLookup operations do not take into account wildcards in SpiceDBEPSS 1.3%CVE-2023-29193HIGHSpiceDB binding metrics port to untrusted networks and can leak command-line flagsEPSS 0.8%CVE-2024-32001LOWSpiceDB: LookupSubjects may return partial results if a specific kind of relation is usedEPSS 0.6%CVE-2024-27101HIGHInteger overflow in chunking helper causes dispatching to miss elements or panicEPSS 0.5%CVE-2023-35930LOWLookupResources may return partial results in spicedbEPSS 0.4%CVE-2023-46255MEDIUM`SPICEDB_DATASTORE_CONN_URI` is leaked when URI cannot be parsedEPSS 0.4%