CVE-2023-45810

OpenFGA is a flexible authorization/permission engine built for developers and inspired by Google Zanzibar. Affected versions of OpenFGA are vulnerable to a denial of service attack. When a number of `ListObjects` calls are executed, in some scenarios, those calls are not releasing resources even after a response has been sent, and given a sufficient call volume the service as a whole becomes unresponsive. This issue has been addressed in version 1.3.4 and the upgrade is considered backwards compatible. There are no known workarounds for this vulnerability.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/openfga/openfga/security/advisories/GHSA-hr4f-6jh8-f2vq	Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:openfga:openfga:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2023-10-17 23:15

Updated : 2023-10-25 13:38

NVD link : CVE-2023-45810

Mitre link : CVE-2023-45810

CVE.ORG link : CVE-2023-45810

JSON object : View

Products Affected

openfga

openfga

CWE

CWE-400

Uncontrolled Resource Consumption

{"id": "CVE-2023-45810", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}, {"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 1.6}]}, "published": "2023-10-17T23:15:12.403", "references": [{"url": "https://github.com/openfga/openfga/security/advisories/GHSA-hr4f-6jh8-f2vq", "tags": ["Third Party Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-400"}]}, {"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-400"}]}], "descriptions": [{"lang": "en", "value": "OpenFGA is a flexible authorization/permission engine built for developers and inspired by Google Zanzibar. Affected versions of OpenFGA are vulnerable to a denial of service attack. When a number of `ListObjects` calls are executed, in some scenarios, those calls are not releasing resources even after a response has been sent, and given a sufficient call volume the service as a whole becomes unresponsive. This issue has been addressed in version 1.3.4 and the upgrade is considered backwards compatible. There are no known workarounds for this vulnerability."}, {"lang": "es", "value": "OpenFGA es un motor de autorizaci\u00f3n/permiso flexible creado para desarrolladores e inspirado en Google Zanzibar. Las versiones afectadas de OpenFGA son vulnerables a un ataque de denegaci\u00f3n de servicio. Cuando se ejecutan varias llamadas `ListObjects`, en algunos escenarios, esas llamadas no liberan recursos incluso despu\u00e9s de que se haya enviado una respuesta y, dado un volumen de llamadas suficiente, el servicio en su conjunto deja de responder. Este problema se solucion\u00f3 en la versi\u00f3n 1.3.4 y la actualizaci\u00f3n se considera compatible con versiones anteriores. No se conocen workarounds para esta vulnerabilidad."}], "lastModified": "2023-10-25T13:38:33.620", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:openfga:openfga:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "0A991E55-6232-4B78-A9C3-4CDD2454AFF7", "versionEndExcluding": "1.3.4"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}