CVE-2023-35933: OpenFGA denial of service die to circular relationship
OPenFGA is an open source authorization/permission engine built for developers. OpenFGA versions v1.1.0 and prior are vulnerable to a DoS attack when Check and ListObjects calls are executed against authorization models that contain circular relationship definitions. Users are affected by this vulnerability if they are using OpenFGA v1.1.0 or earlier, and if you are executing Check or ListObjects calls against a vulnerable authorization model. Users are advised to upgrade to version 1.1.1. There are no known workarounds for this vulnerability. Users that do not have circular relationships in their models are not affected.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
OpenFGAto a version that resolves this vulnerability.Fixed in 1.1.1
Event History
Frequently Asked Questions
What is CVE-2023-35933?
CVE-2023-35933 is a vulnerability in OpenFGA, an open source authorization/permission engine, that allows for a denial-of-service (DoS) attack when certain calls are made against authorization models with circular relationship definitions.
How does CVE-2023-35933 affect users?
Users of OpenFGA versions 1.1.0 and prior are affected by CVE-2023-35933. They are vulnerable to a DoS attack when executing Check and ListObjects calls against authorization models with circular relationship definitions.
What is the severity of CVE-2023-35933?
CVE-2023-35933 has a severity rating of high, with a CVSS score of 7.5.
How can I fix CVE-2023-35933?
To fix CVE-2023-35933, users should upgrade to OpenFGA version 1.1.1 or later, which includes the necessary security patches.
Where can I find more information about CVE-2023-35933?
For more information about CVE-2023-35933, you can refer to the GitHub commit and security advisories provided by OpenFGA in the references section.