CVE-2024-48909
Description
SpiceDB is an open source database for scalably storing and querying fine-grained authorization data. Starting in version 1.35.0 and prior to version 1.37.1, clients that have enabled `LookupResources2` and have caveats in the evaluation path for their requests can return a permissionship of `CONDITIONAL` with context marked as missing, even then the context was supplied. LookupResources2 is the new default in SpiceDB 1.37.0 and has been opt-in since SpiceDB 1.35.0. The bug is patched as part of SpiceDB 1.37.1. As a workaround, disable LookupResources2 via the `--enable-experimental-lookup-resources` flag by setting it to `false`.
How to fix
- authzed spicedb1.37.1 or later
- github.com/authzed/spicedb1.37.1 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| authzed spicedb | 1.35.0 ≤ v < 1.37.1 | 1.37.1 |
| github.com/authzed/spicedbGo | 1.35.0 ≤ v < 1.37.1 | 1.37.1 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.