github - ghsa-m54h-5x5f-5m6r

ghsa-m54h-5x5f-5m6r

Vulnerability from github

Published

2023-06-28 22:48

Modified

2023-06-30 20:25

Severity ?

3.7 (Low) - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

Summary

SpiceDB's LookupResources may return partial results

Details

Impact

Any user making a negative authorization decision based on the results of a LookupResources request with 1.22.0 is affected.

For example, using LookupResources to find a list of resources to allow access to be okay: some subjects that should have access to a resource may not. But if using LookupResources to find a list of banned resources instead, then some users that shouldn't have access may.

Generally, LookupResources is not and should not be used to gate access in this way - that's what the Check API is for. Additionally, version 1.22.0 has included a warning about this bug since its initial release.

Workarounds

Avoid using LookupResources for negative authorization decisions if using 1.22.0.

Patches

The only affected release is v1.22.0, and it is patched in v1.22.2 (there is no v1.22.1 release, though there is a git tag).

References

https://github.com/authzed/spicedb/pull/1397

For more information

If you have any questions or comments about this advisory: * Open an issue in SpiceDB * Ask a question in the SpiceDB Discord

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/authzed/spicedb"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "1.22.0"
            },
            {
              "fixed": "1.22.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.22.0"
      ]
    }
  ],
  "aliases": [
    "CVE-2023-35930"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-913"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2023-06-28T22:48:50Z",
    "nvd_published_at": "2023-06-26T20:15:10Z",
    "severity": "LOW"
  },
  "details": "### Impact\nAny user making a negative authorization decision based on the results of a LookupResources request with 1.22.0 is affected.\n\nFor example, using `LookupResources` to find a list of resources to allow access to be okay: some subjects that should have access to a resource may not. But if using `LookupResources` to find a list of banned resources instead, then some users that shouldn\u0027t have access may.\n\nGenerally, `LookupResources` is not and should not be used to gate access in this way - that\u0027s what the `Check` API is for. Additionally, version 1.22.0 has included a warning about this bug since its initial release.\n\n### Workarounds\nAvoid using `LookupResources` for negative authorization decisions if using `1.22.0`. \n\n### Patches\nThe only affected release is [v1.22.0](https://github.com/authzed/spicedb/releases/tag/v1.22.0), and it is patched in [v1.22.2](https://github.com/authzed/spicedb/releases/tag/v1.22.2) (there is no v1.22.1 release, though there is a git tag).\n\n### References\n- https://github.com/authzed/spicedb/pull/1397\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open an issue in [SpiceDB](https://github.com/authzed/spicedb)\n* Ask a question in the [SpiceDB Discord](https://authzed.com/discord)\n",
  "id": "GHSA-m54h-5x5f-5m6r",
  "modified": "2023-06-30T20:25:41Z",
  "published": "2023-06-28T22:48:50Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/authzed/spicedb/security/advisories/GHSA-m54h-5x5f-5m6r"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-35930"
    },
    {
      "type": "WEB",
      "url": "https://github.com/authzed/spicedb/pull/1397"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/authzed/spicedb"
    },
    {
      "type": "WEB",
      "url": "https://github.com/authzed/spicedb/releases/tag/v1.22.2"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "SpiceDB\u0027s LookupResources may return partial results"
}

CVE-2023-35930 (GCVE-0-2023-35930)

Vulnerability from cvelistv5

Published

2023-06-26 19:32

Modified

2024-11-06 21:06

Severity ?

3.7 (Low) - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

CWE

CWE-913 - Improper Control of Dynamically-Managed Code Resources

Summary

SpiceDB is an open source, Google Zanzibar-inspired, database system for creating and managing security-critical application permissions. Any user making a negative authorization decision based on the results of a `LookupResources` request with 1.22.0 is affected. For example, using `LookupResources` to find a list of resources to allow access to be okay: some subjects that should have access to a resource may not. But if using `LookupResources` to find a list of banned resources instead, then some users that shouldn't have access may. Generally, `LookupResources` is not and should not be to gate access in this way - that's what the `Check` API is for. Additionally, version 1.22.0 has included a warning about this bug since its initial release. Users are advised to upgrade to version 1.22.2. Users unable to upgrade should avoid using `LookupResources` for negative authorization decisions.

References

►

URL

Tags

	https://github.com/authzed/spicedb/security/advisories/GHSA-m54h-5x5f-5m6r	x_refsource_CONFIRM
	https://github.com/authzed/spicedb/pull/1397	x_refsource_MISC

Impacted products

	Vendor	Product	Version
	authzed	spicedb	Version: = 1.22.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T16:37:41.191Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "https://github.com/authzed/spicedb/security/advisories/GHSA-m54h-5x5f-5m6r",
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/authzed/spicedb/security/advisories/GHSA-m54h-5x5f-5m6r"
          },
          {
            "name": "https://github.com/authzed/spicedb/pull/1397",
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/authzed/spicedb/pull/1397"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-35930",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-11-06T21:06:20.932122Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-11-06T21:06:28.339Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "spicedb",
          "vendor": "authzed",
          "versions": [
            {
              "status": "affected",
              "version": "= 1.22.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "SpiceDB is an open source, Google Zanzibar-inspired, database system for creating and managing security-critical application permissions. Any user making a negative authorization decision based on the results of a `LookupResources` request with 1.22.0 is affected. For example, using `LookupResources` to find a list of resources to allow access to be okay: some subjects that should have access to a resource may not. But if using `LookupResources` to find a list of banned resources instead, then some users that shouldn\u0027t have access may. Generally, `LookupResources` is not and should not be to gate access in this way - that\u0027s what the `Check` API is for. Additionally, version 1.22.0 has included a warning about this bug since its initial release. Users are advised to upgrade to version 1.22.2. Users unable to upgrade should avoid using `LookupResources` for negative authorization decisions."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 3.7,
            "baseSeverity": "LOW",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-913",
              "description": "CWE-913: Improper Control of Dynamically-Managed Code Resources",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-06-26T19:32:59.829Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/authzed/spicedb/security/advisories/GHSA-m54h-5x5f-5m6r",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/authzed/spicedb/security/advisories/GHSA-m54h-5x5f-5m6r"
        },
        {
          "name": "https://github.com/authzed/spicedb/pull/1397",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/authzed/spicedb/pull/1397"
        }
      ],
      "source": {
        "advisory": "GHSA-m54h-5x5f-5m6r",
        "discovery": "UNKNOWN"
      },
      "title": "LookupResources may return partial results in spicedb"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2023-35930",
    "datePublished": "2023-06-26T19:32:59.829Z",
    "dateReserved": "2023-06-20T14:02:45.593Z",
    "dateUpdated": "2024-11-06T21:06:28.339Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted

ghsa-m54h-5x5f-5m6r

Vulnerability from github

Impact

Workarounds

Patches

References

For more information

CVE-2023-35930 (GCVE-0-2023-35930)

Vulnerability from cvelistv5

Tags

Sightings

Nomenclature