GitHub Advisoryadvisory · Go

GHSA-rxpw-85vw-fx87 OpenFGA denial of service

MEDIUM Published 2024-01-26 Modified 2024-01-26 Official page ↗
Aliases
CVE-2024-23820
Ecosystem
Go
Packages
github.com/openfga/openfga
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-401, CWE-770
Reviewed
2024-01-26

Affected packages

• Go github.com/openfga/openfga: < 1.4.3 → fixed in 1.4.3

Description

Overview OpenFGA is vulnerable to a DoS attack. In some scenarios that depend on the model and tuples used, a call to ListObjects may not release memory properly. So when a sufficiently high number of those calls are executed, the OpenFGA server can create an "out of memory" error and terminate. Fix Upgrade to v1.4.3. This upgrade is backwards compatible.

Related

Alias · CVE (1)

  • CVE-2024-23820 OpenFGA, an authorization/permission engine, is vulnerable to a denial of service attack in versions prior to 1.4.3. vulnerability

Weakness · CWE (2)

  • CWE-401 Missing Release of Memory after Effective Lifetime weakness
  • CWE-770 Allocation of Resources Without Limits or Throttling weakness

References