CVE-2023-35933

MEDIUM5.9EPSS 0.40%

Denial of service in github.com/openfga/openfga

Published: 6/28/2023Modified: 5/20/2024

Description

OpenFGA is vulnerable to a denial of service attack when certain Check and ListObjects calls are executed against authorization models that contain circular relationship definitions.

Affected packages (2)

Go/github.com/openfga/openfgafrom 0, < 1.1.1
Go/github.com/openfga/openfgafrom 0, < 1.1.1

CVSS scores

Source	Version	Severity	Vector
osv	CVSS 3.1	MEDIUM5.9	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

References (6)

ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2023-35933
PATCHhttps://github.com/openfga/openfga
WEBhttps://github.com/openfga/openfga/commit/087ce392595f3c319ab3028b5089118ea4063452
WEBhttps://github.com/openfga/openfga/security/advisories/GHSA-hr9r-8phq-5x8j
WEBhttps://openfga.dev/api/service#/Relationship%20Queries/Check
WEBhttps://openfga.dev/api/service#/Relationship%20Queries/ListObjects