CVE-2024-27101
High
Description
SpiceDB is an open source, Google Zanzibar-inspired database for creating and managing security-critical application permissions. Integer overflow in chunking helper causes dispatching to miss elements or panic. Any SpiceDB cluster with any schema where a resource being checked has more than 65535 relationships for the same resource and subject type is affected by this problem. The CheckPermission, BulkCheckPermission, and LookupSubjects API methods are affected. This vulnerability is fixed in 1.29.2.
SeverityHigh
CVSS7.3
Exploit probability—
ProductAuthzed Spicedb
PublishedMar 1, 2024
First seenMar 1, 2024
Weakness typeCWE-190Integer overflow
How to fix
Update
- authzed spicedb1.29.2 or later
- github.com/authzed/spicedb1.29.2 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| authzed spicedb | v < 1.29.2 | 1.29.2 |
| github.com/authzed/spicedbGo | v < 1.29.2 | 1.29.2 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.