CVE-2024-32001 SpiceDB: LookupSubjects may return partial results if a specific kind of relation is used

SpiceDB is a graph database purpose-built for storing and evaluating access control data. Use of a relation of the form: relation folder: folder | folderparent with an arrow such as folder-view can cause LookupSubjects to only return the subjects found under subjects for either folder or...

CVE-2024-32001

Summary: CVE-2024-32001 affects SpiceDB. A bug in relations of the form folder: folder | folder#parent, when the same subject type is used multiple times and an arrow is used over the relation, can cause LookupSubjects to return only a subset of subjects. This affects any user making a negative a...

CVE-2024-32001 SpiceDB: LookupSubjects may return partial results if a specific kind of relation is used

SpiceDB is a graph database purpose-built for storing and evaluating access control data. Use of a relation of the form: relation folder: folder | folderparent with an arrow such as folder-view can cause LookupSubjects to only return the subjects found under subjects for either folder or...

CVE-2024-32001 SpiceDB: LookupSubjects may return partial results if a specific kind of relation is used

SpiceDB is a graph database purpose-built for storing and evaluating access control data. Use of a relation of the form: relation folder: folder | folderparent with an arrow such as folder-view can cause LookupSubjects to only return the subjects found under subjects for either folder or...

SpiceDB 安全漏洞

SpiceDB is a fine-grained permissions database inspired by Google Zanzibar. A security vulnerability exists in SpiceDB versions prior to v1.30.1, which stems from the fact that LookupSubjects may return partially sensitive information if certain types of relationships are used...

CVE-2024-27304 vulnerabilities

Vulnerabilities for packages: temporal-server, caddy, kots, step-ca, src, trillian, amass, step, ferretdb, argo-workflows, k3s, kube-bench, kine, spicedb...

CVE-2024-27304 vulnerabilities

Vulnerabilities for packages: trillian-fips, argo-workflows-fips, k3s, argo-workflows, src, trillian, kine, temporal-server, amass, wavefront-collector-for-kubernetes, temporal-server-fips, kube-bench-fips, falcosidekick-fips, caddy-fips, kube-bench, kots, caddy, spicedb, ferretdb, step-ca, step...

GHSA-7JWH-3VRQ-Q3M8 vulnerabilities

Vulnerabilities for packages: temporal-server, caddy, kots, step-ca, src, trillian, amass, step, ferretdb, argo-workflows, k3s, kube-bench, kine, spicedb...

GHSA-7JWH-3VRQ-Q3M8 vulnerabilities

Vulnerabilities for packages: trillian-fips, argo-workflows-fips, k3s, argo-workflows, src, trillian, kine, temporal-server, amass, wavefront-collector-for-kubernetes, temporal-server-fips, kube-bench-fips, falcosidekick-fips, caddy-fips, kube-bench, kots, caddy, spicedb, ferretdb, step-ca, step...

GHSA-MRWW-27VC-GGHV vulnerabilities

Vulnerabilities for packages: trillian-fips, argo-workflows-fips, k3s, argo-workflows, src, trillian, kine, temporal-server, amass, wavefront-collector-for-kubernetes, temporal-server-fips, kube-bench-fips, falcosidekick-fips, caddy-fips, kube-bench, kots, caddy, spicedb, ferretdb, step-ca, step...

Integer Overflow

github.com/authzed/spicedb is vulnerable to Integer Overflow. The vulnerability is due to a potential panic scenario, rendering the server unavailable and this arises from an excessive number of relationships for a specific resource and subject type within any SpiceDB cluster. It may lead to...

Integer overflow in chunking helper causes dispatching to miss elements or panic

Any SpiceDB cluster with any schema where a resource being checked has more than 65535 relationships for the same resource and subject type is affected by this problem. The issue may also lead to a panic rendering the server unavailable The following API methods are affected: - CheckPermission -...

GHSA-H3M7-RQC4-7H9P Integer overflow in chunking helper causes dispatching to miss elements or panic

Any SpiceDB cluster with any schema where a resource being checked has more than 65535 relationships for the same resource and subject type is affected by this problem. The issue may also lead to a panic rendering the server unavailable The following API methods are affected: - CheckPermission -...

GHSA-H3M7-RQC4-7H9P vulnerabilities

Vulnerabilities for packages: spicedb...

GHSA-H3M7-RQC4-7H9P vulnerabilities

Vulnerabilities for packages: spicedb...

CVE-2024-27101

SpiceDB is an open source, Google Zanzibar-inspired database for creating and managing security-critical application permissions. Integer overflow in chunking helper causes dispatching to miss elements or panic. Any SpiceDB cluster with any schema where a resource being checked has more than 6553...

CVE-2024-27101 vulnerabilities

Vulnerabilities for packages: spicedb...

CVE-2024-27101 vulnerabilities

Vulnerabilities for packages: spicedb...

Integer overflow

SpiceDB is an open source, Google Zanzibar-inspired database for creating and managing security-critical application permissions. Integer overflow in chunking helper causes dispatching to miss elements or panic. Any SpiceDB cluster with any schema where a resource being checked has more than 6553...

CVE-2024-27101

CVE-2024-27101 affects SpiceDB (Google Zanzibar-inspired permissions store). The root cause is an integer overflow in the chunking helper, which can cause dispatching to miss elements or panic when a resource has more than 65,535 relationships for a given resource and subject type. Affected API m...