OPA for Windows has an SMB force-authentication vulnerability

A SMB force-authentication vulnerability exists in all versions of OPA for Windows prior to v0.68.0. The vulnerability exists because of improper input validation, allowing a user to pass an arbitrary SMB share instead of a Rego file as an argument to OPA CLI or to one of the OPA Go library’s...

GHSA-C77R-FH37-X2PX vulnerabilities

Vulnerabilities for packages: cosign, kots, conftest, snyk-cli, kubescape, k8sgpt, zot, policy-controller, zarf, spire-server, tfsec, opa...

CVE-2024-8260 vulnerabilities

Vulnerabilities for packages: cosign, kots, conftest, snyk-cli, kubescape, k8sgpt, zot, policy-controller, zarf, spire-server, tfsec, opa...

CVE-2024-8260

A SMB force-authentication vulnerability exists in all versions of OPA for Windows prior to v0.68.0. The vulnerability exists because of improper input validation, allowing a user to pass an arbitrary SMB share instead of a Rego file as an argument to OPA CLI or to one of the OPA Go library’s...

CVE-2024-8260 vulnerabilities

Vulnerabilities for packages: snyk-cli, spire-server, tfsec, conftest-fips, kyverno-fips, zot, policy-controller, cosign-fips, conftest, opa, zarf, k8sgpt, kyverno, spire-server-fips, kots, kubescape, cosign, policy-controller-fips...

CVE-2024-8260 OPA SMB Force-Authentication

A SMB force-authentication vulnerability exists in all versions of OPA for Windows prior to v0.68.0. The vulnerability exists because of improper input validation, allowing a user to pass an arbitrary SMB share instead of a Rego file as an argument to OPA CLI or to one of the OPA Go library’s...

CVE-2024-8260

Technical details for CVE-2024-8260 are not publicly available in the provided connected documents. The initial description mentions OPA on Windows and an SMB force-authentication issue, but no concrete affected versions, impact, exploit data, or fixes are given here. Monitor for updates.

CVE-2024-8260 OPA SMB Force-Authentication

A SMB force-authentication vulnerability exists in all versions of OPA for Windows prior to v0.68.0. The vulnerability exists because of improper input validation, allowing a user to pass an arbitrary SMB share instead of a Rego file as an argument to OPA CLI or to one of the OPA Go library’s...

CVE-2024-8260 OPA SMB Force-Authentication

A SMB force-authentication vulnerability exists in all versions of OPA for Windows prior to v0.68.0. The vulnerability exists because of improper input validation, allowing a user to pass an arbitrary SMB share instead of a Rego file as an argument to OPA CLI or to one of the OPA Go library’s...

CVE-2024-24786 affecting package opa for versions less than 0.63.0-1

CVE-2024-24786 affecting package opa for versions less than 0.63.0-1. An upgraded version of the package is available that resolves this issue...

CVE-2023-45142 affecting package opa for versions less than 0.63.0-1

CVE-2023-45142 affecting package opa for versions less than 0.63.0-1. An upgraded version of the package is available that resolves this issue...

CVE-2023-45288 affecting package opa for versions less than 0.63.0-1

CVE-2023-45288 affecting package opa for versions less than 0.63.0-1. A patched version of the package is available...

Information Disclosure

fastapi-opa is vulnerable to Information Disclosure. The vulnerability is due to lack of authentication enforcement for HTTP OPTIONS requests by OpaMiddleware, allowing an unauthenticated attacker to determine the existence of entities within the application based on the responses to these reques...

CVE-2024-40627

Fastapi OPA is an opensource fastapi middleware which includes auth flow. HTTP OPTIONS requests are always allowed by OpaMiddleware, even when they lack authentication, and are passed through directly to the application. OpaMiddleware allows all HTTP OPTIONS requests without evaluating it against...

CVE-2024-40627

Fastapi OPA is an opensource fastapi middleware which includes auth flow. HTTP OPTIONS requests are always allowed by OpaMiddleware, even when they lack authentication, and are passed through directly to the application. OpaMiddleware allows all HTTP OPTIONS requests without evaluating it against...

CVE-2024-40627

CVE-2024-40627 concerns the Fastapi-OPA OpaMiddleware, which incorrectly allows unauthenticated HTTP OPTIONS requests by bypassing policy evaluation. This can enable an unauthenticated attacker to infer entity existence based on responses, potentially leaking information about writable entities. ...

CVE-2024-40627 OpaMiddleware does not filter HTTP OPTIONS requests

Fastapi OPA is an opensource fastapi middleware which includes auth flow. HTTP OPTIONS requests are always allowed by OpaMiddleware, even when they lack authentication, and are passed through directly to the application. OpaMiddleware allows all HTTP OPTIONS requests without evaluating it against...

CVE-2024-40627 OpaMiddleware does not filter HTTP OPTIONS requests

Fastapi OPA is an opensource fastapi middleware which includes auth flow. HTTP OPTIONS requests are always allowed by OpaMiddleware, even when they lack authentication, and are passed through directly to the application. OpaMiddleware allows all HTTP OPTIONS requests without evaluating it against...

fastflows (>=0.1.0 <=0.1.2) potentially affected by CVE-2024-40627 via fastapi-opa (=1.4.8)

fastapi-opa PYPI version =1.4.8 is affected by a known vulnerability. The following packages have a transitive dependency on fastapi-opa and may be impacted: - fastflows =0.1.0, =0.1.2 Source cves: CVE-2024-40627 Source advisory: OSV:GHSA-5F5C-8RVC-J8WF...

GHSA-5F5C-8RVC-J8WF OpaMiddleware does not filter HTTP OPTIONS requests

Summary HTTP OPTIONS requests are always allowed by OpaMiddleware, even when they lack authentication, and are passed through directly to the application. The maintainer uncertain whether this should be classed as a "bug" or "security issue" – but is erring on the side of "security issue" as an...