Vulnerability · Published Oct 17, 2023 · Assigned by GitHub_M
CVE-2023-45810OpenFGA denial of service
Medium 5.3
In plain English
A medium-severity uncontrolled resource consumption in openfga from openfga. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 49% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
OpenFGA is a flexible authorization/permission engine built for developers and inspired by Google Zanzibar. Affected versions of OpenFGA are vulnerable to a denial of service attack. When a number of `ListObjects` calls are executed, in some scenarios, those calls are not releasing resources even after a response has been sent, and given a sufficient call volume the service as a whole becomes unresponsive. This issue has been addressed in version 1.3.4 and the upgrade is considered backwards compatible. There are no known workarounds for this vulnerability.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Go | github.com/openfga/openfga | 1.3.4 | GHSA-hr4f-6jh8-f2vq |
| Go | github.com/openfga/openfga | 1.3.4 | GO-2023-2121 |
Affected products (as reported)
Weakness: CWE-400 · Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
References
- https://github.com/openfga/openfga/security/advisories/GHSA-hr4f-6jh8-f2vq x_refsource_CONFIRM