x/vulndb: potential Go vuln in github.com/openfga/openfga: CVE-2024-31452

[GoVulnBot]

CVE-2024-31452 references github.com/openfga/openfga, which may be a Go module.

Description:
OpenFGA is a high-performance and flexible authorization/permission engine. Some end users of OpenFGA v1.5.0 or later are vulnerable to authorization bypass when calling Check or ListObjects APIs. You are very likely affected if your model involves exclusion (e.g. a but not b) or intersection (e.g. a and b). This vulnerability is fixed in v1.5.3.

References:

• NIST: https://nvd.nist.gov/vuln/detail/CVE-2024-31452
• JSON: https://github.com/CVEProject/cvelist/tree/6c14a102ad9e9471fb98226b6b2c47f5d84d13c7/2024/31xxx/CVE-2024-31452.json
• advisory: GHSA-8cph-m685-6v6r
• fix: openfga/openfga@b6a6d99
• Imported by: https://pkg.go.dev/github.com/openfga/openfga?tab=importedby

Cross references:

• Module github.com/openfga/openfga appears in issue x/vulndb: potential Go vuln in github.com/openfga/openfga: CVE-2022-39340 #1079 EFFECTIVELY_PRIVATE
• Module github.com/openfga/openfga appears in issue x/vulndb: potential Go vuln in github.com/openfga/openfga: CVE-2022-39341 #1080 EFFECTIVELY_PRIVATE
• Module github.com/openfga/openfga appears in issue x/vulndb: potential Go vuln in github.com/openfga/openfga: CVE-2022-39342 #1081 EFFECTIVELY_PRIVATE
• Module github.com/openfga/openfga appears in issue x/vulndb: potential Go vuln in github.com/openfga/openfga: CVE-2022-39352 #1099 EFFECTIVELY_PRIVATE
• Module github.com/openfga/openfga appears in issue x/vulndb: potential Go vuln in github.com/openfga/openfga: CVE-2022-23542 #1179 EFFECTIVELY_PRIVATE
• Module github.com/openfga/openfga appears in issue x/vulndb: potential Go vuln in github.com/openfga/openfga: GHSA-jcf2-mxr2-gmqp #2028 EFFECTIVELY_PRIVATE
• Module github.com/openfga/openfga appears in issue x/vulndb: potential Go vuln in github.com/openfga/openfga: CVE-2023-43645 #2084 EFFECTIVELY_PRIVATE
• Module github.com/openfga/openfga appears in issue x/vulndb: potential Go vuln in github.com/openfga/openfga: CVE-2023-45810 #2121 EFFECTIVELY_PRIVATE
• Module github.com/openfga/openfga appears in issue x/vulndb: potential Go vuln in github.com/openfga/openfga: CVE-2024-23820 #2477 EFFECTIVELY_PRIVATE
• Module github.com/openfga/openfga appears in issue x/vulndb: potential Go vuln in github.com/openfga/openfga: CVE-2023-35933 #1872

See doc/triage.md for instructions on how to triage this report.

id: GO-ID-PENDING
modules:
    - module: github.com/openfga/openfga
      vulnerable_at: 1.5.2
      packages:
        - package: openfga
cves:
    - CVE-2024-31452
references:
    - advisory: https://github.com/openfga/openfga/security/advisories/GHSA-8cph-m685-6v6r
    - fix: https://github.com/openfga/openfga/commit/b6a6d99b2bdbf8c3781503989576076289f48ed2

[gopherbot]

Change https://go.dev/cl/586484 mentions this issue: data/reports: add 73 unreviewed reports

[gopherbot]

Change https://go.dev/cl/590039 mentions this issue: data/reports: add 51 reports