Encoding Error Affecting github.com/authzed/spicedb/internal/graph package, versions >=1.35.0 <1.37.1
Threat Intelligence
EPSS
0.05% (16th
percentile)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-GOLANG-GITHUBCOMAUTHZEDSPICEDBINTERNALGRAPH-8186425
- published 15 Oct 2024
- disclosed 14 Oct 2024
- credit Unknown
Introduced: 14 Oct 2024
CVE-2024-48909 Open this link in a new tabHow to fix?
Upgrade github.com/authzed/spicedb/internal/graph to version 1.37.1 or higher.
Overview
Affected versions of this package are vulnerable to Encoding Error via the LookupResources2 process. An attacker can receive incorrect permissions information by exploiting the evaluation path when caveats are used.
Note:
This is only exploitable if LookupResources2 is enabled and caveats are present in the evaluation path.
Workaround
This vulnerability can be mitigated by disabling LookupResources2 via the --enable-experimental-lookup-resources flag by setting it to false.