CVE-2024-27101

2024-03-0121:15:08

CWE-190

[email protected]

web.nvd.nist.gov

spicedb

cve-2024-27101

security-critical

integer overflow

google zanzibar-inspired database

permission management

7.3 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

HIGH

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:N/I:H/A:H

7 High

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

9.1%

JSON

SpiceDB is an open source, Google Zanzibar-inspired database for creating and managing security-critical application permissions. Integer overflow in chunking helper causes dispatching to miss elements or panic. Any SpiceDB cluster with any schema where a resource being checked has more than 65535 relationships for the same resource and subject type is affected by this problem. The CheckPermission, BulkCheckPermission, and LookupSubjects API methods are affected. This vulnerability is fixed in 1.29.2.

Affected configurations

Vulners

Node

authzedspicedbRange<1.29.2

VendorProductVersionCPE
authzedspicedb*cpe:2.3:a:authzed:spicedb:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
authzed	spicedb	*	cpe:2.3:a:authzed:spicedb::::::::

CNA Affected

[
  {
    "vendor": "authzed",
    "product": "spicedb",
    "versions": [
      {
        "version": "< 1.29.2",
        "status": "affected"
      }
    ]
  }
]