Ecosyste.ms: Advisories

Security Advisories: GSA_kwCzR0hTQS1tNTRoLTV4NWYtNW02cs4AA0IM

SpiceDB's LookupResources may return partial results

Impact

Any user making a negative authorization decision based on the results of a LookupResources request with 1.22.0 is affected.

For example, using LookupResources to find a list of resources to allow access to be okay: some subjects that should have access to a resource may not. But if using LookupResources to find a list of banned resources instead, then some users that shouldn't have access may.

Generally, LookupResources is not and should not be used to gate access in this way - that's what the Check API is for. Additionally, version 1.22.0 has included a warning about this bug since its initial release.

Workarounds

Avoid using LookupResources for negative authorization decisions if using 1.22.0.

Patches

The only affected release is v1.22.0, and it is patched in v1.22.2 (there is no v1.22.1 release, though there is a git tag).

References

• https://github.com/authzed/spicedb/pull/1397

For more information

If you have any questions or comments about this advisory:

• Open an issue in SpiceDB
• Ask a question in the SpiceDB Discord

Permalink: https://github.com/advisories/GHSA-m54h-5x5f-5m6r
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1tNTRoLTV4NWYtNW02cs4AA0IM
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Low
Classification: General
Published: 10 months ago
Updated: 6 months ago

CVSS Score: 3.7
CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

Identifiers: GHSA-m54h-5x5f-5m6r, CVE-2023-35930
References:

• https://github.com/authzed/spicedb/security/advisories/GHSA-m54h-5x5f-5m6r
• https://nvd.nist.gov/vuln/detail/CVE-2023-35930
• https://github.com/authzed/spicedb/pull/1397
• https://github.com/authzed/spicedb/releases/tag/v1.22.2
• https://github.com/advisories/GHSA-m54h-5x5f-5m6r

Repository: https://github.com/authzed/spicedb
Blast Radius: 4.6

Affected Packages