VDB
Sign up
MEDIUM5.0

GHSA-8396-jffm-qx4w

OpenFGA has cache-key delimiter injection in shared-iterator and v2 iterator that caches enables intra-store authorization-decision poisoning

Quick fix

GHSA-8396-jffm-qx4w — github.com/openfga/openfga: upgrade to the fixed version with the command below.

go get github.com/openfga/openfga@v1.16.0

Details

### Description In OpenFGA, when iterator caching is enabled, two distinct check requests can produce the same cache key, leading to OpenFGA reusing an earlier cached result for a subsequent request.

### Preconditions This applies if the following preconditions are present:

- FGA runs with SharedIteratorCache enabled, - FGA runs with ListObjectsIteratorCache enabled.

### Fix Upgrade to version 1.16.0 or greater.

### Acknowledgements OpenFGA would like to thank @j4xT for the discovery and the detailed report.

Are you affected?

Enter the version of the package you're using.

Affected packages

Go/github.com/openfga/openfga
Introduced in: 0Fixed in: 1.16.0
Fixgo get github.com/openfga/openfga@v1.16.0

References