CVE-2023-45810: OpenFGA denial of service
Overview OpenFGA is vulnerable to a DoS attack. When a number of ListObjects calls are executed, in some scenarios, those calls are not releasing resources even after a response has been sent, and the service as a whole becomes unresponsive.
Fix Upgrade to v1.3.4. This upgrade is backwards compatible.
Other sources
OpenFGA is a flexible authorization/permission engine built for developers and inspired by Google Zanzibar. Affected versions of OpenFGA are vulnerable to a denial of service attack. When a number of ListObjects calls are executed, in some scenarios, those calls are not releasing resources even after a response has been sent, and given a sufficient call volume the service as a whole becomes unresponsive. This issue has been addressed in version 1.3.4 and the upgrade is considered backwards compatible. There are no known workarounds for this vulnerability.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2023-45810?
CVE-2023-45810 is a vulnerability in the OpenFGA software that can be exploited for a denial of service (DoS) attack.
What is OpenFGA?
OpenFGA is a flexible authorization/permission engine inspired by Google Zanzibar.
How does CVE-2023-45810 affect OpenFGA?
CVE-2023-45810 affects OpenFGA by allowing an attacker to execute a denial of service attack by repeatedly making 'ListObjects' calls that do not release resources as intended.
What is the severity of CVE-2023-45810?
The severity of CVE-2023-45810 is medium with a CVSS score of 5.3.
How can I fix CVE-2023-45810?
To fix CVE-2023-45810, upgrade OpenFGA to version 1.3.4 or higher.