216 matches found
CVE-2024-38361 vulnerabilities
Vulnerabilities for packages: spicedb...
CVE-2024-38361 Permissions processing error in spacedb
Spicedb is an Open Source, Google Zanzibar-inspired permissions database to enable fine-grained authorization for customer applications. Use of an exclusion under an arrow that has multiple resources may resolve to NOPERMISSION when permission is expected. If the resource exists under multiple...
CVE-2024-38361 Permissions processing error in spacedb
Spicedb is an Open Source, Google Zanzibar-inspired permissions database to enable fine-grained authorization for customer applications. Use of an exclusion under an arrow that has multiple resources may resolve to NOPERMISSION when permission is expected. If the resource exists under multiple...
CVE-2024-38361
SpiceDB (spicedb) vulnerability CVE-2024-38361 affects the permission-check flow: an exclusion under an arrow with multiple resources may cause a NO_PERMISSION response when PERMISSION is expected on CheckPermission, due to a failure in the exclusion dispatcher to query all folders a user can acc...
CVE-2024-38361 Permissions processing error in spacedb
Spicedb is an Open Source, Google Zanzibar-inspired permissions database to enable fine-grained authorization for customer applications. Use of an exclusion under an arrow that has multiple resources may resolve to NOPERMISSION when permission is expected. If the resource exists under multiple...
SpiceDB exclusions can result in no permission returned when permission expected
Background Use of an exclusion under an arrow that has multiple resources may resolve to NOPERMISSION when permission is expected. For example, given this schema: zed definition user definition folder relation member: user relation banned: user permission view = member - banned definition resourc...
GHSA-GRJV-GJGR-66G2 SpiceDB exclusions can result in no permission returned when permission expected
Background Use of an exclusion under an arrow that has multiple resources may resolve to NOPERMISSION when permission is expected. For example, given this schema: zed definition user definition folder relation member: user relation banned: user permission view = member - banned definition resourc...
GHSA-GRJV-GJGR-66G2 vulnerabilities
Vulnerabilities for packages: spicedb...
GHSA-GRJV-GJGR-66G2 vulnerabilities
Vulnerabilities for packages: spicedb...
Spicedb Security Vulnerabilities
SpiceDB is a fine-grained permissions database from the Authzed team. A security vulnerability exists in versions of Spicedb prior to v1.33.1, which stems from the fact that if a resource exists under multiple folders and a user is authorized to view multiple folders, SpiceDB may report that the...
GHSA-87M9-RV8P-RGMG vulnerabilities
Vulnerabilities for packages: opentelemetry-collector-contrib-fips, opentelemetry-collector-contrib, opentelemetry-collector-fips, tempo, spicedb, tempo-fips, opentelemetry-collector...
GHSA-87M9-RV8P-RGMG vulnerabilities
Vulnerabilities for packages: opentelemetry-collector, opentelemetry-collector-contrib, tempo, spicedb...
GO-2024-2716 SpiceDB: LookupSubjects may return partial results if a specific kind of relation is used in github.com/authzed/spicedb
SpiceDB: LookupSubjects may return partial results if a specific kind of relation is used in github.com/authzed/spicedb...
CVE-2024-32001
SpiceDB is a graph database purpose-built for storing and evaluating access control data. Use of a relation of the form: relation folder: folder | folderparent with an arrow such as folder-view can cause LookupSubjects to only return the subjects found under subjects for either folder or...
CVE-2024-32001 vulnerabilities
Vulnerabilities for packages: spicedb...
CVE-2024-32001 vulnerabilities
Vulnerabilities for packages: spicedb...
SpiceDB: LookupSubjects may return partial results if a specific kind of relation is used
Background Use of a relation of the form: relation folder: folder | folderparent with an arrow such as folder-view can cause LookupSubjects to only return the subjects found under subjects for either folder or folderparent. This bug only manifests if the same subject type is used multiple types i...
GHSA-J85Q-46HG-36P2 SpiceDB: LookupSubjects may return partial results if a specific kind of relation is used
Background Use of a relation of the form: relation folder: folder | folderparent with an arrow such as folder-view can cause LookupSubjects to only return the subjects found under subjects for either folder or folderparent. This bug only manifests if the same subject type is used multiple types i...