CVE-2024-23820: OpenFGA DoS
Overview OpenFGA is vulnerable to a DoS attack. In some scenarios that depend on the model and tuples used, a call to ListObjects may not release memory properly. So when a sufficiently high number of those calls are executed, the OpenFGA server can create an "out of memory" error and terminate.
Fix Upgrade to v1.4.3. This upgrade is backwards compatible.
Other sources
OpenFGA, an authorization/permission engine, is vulnerable to a denial of service attack in versions prior to 1.4.3. In some scenarios that depend on the model and tuples used, a call to ListObjects may not release memory properly. So when a sufficiently high number of those calls are executed, the OpenFGA server can create an out of memory error and terminate. Version 1.4.3 contains a patch for this issue.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
go/github.com/openfga/openfgato a version that resolves this vulnerability.Fixed in 1.4.3 - Upgrade
Upgrade
OpenFGAto a version that resolves this vulnerability.Fixed in 1.4.3
Event History
Frequently Asked Questions
What is the severity of CVE-2024-23820?
CVE-2024-23820 is classified as a high severity vulnerability due to its potential for causing denial of service.
How do I fix CVE-2024-23820?
To fix CVE-2024-23820, upgrade OpenFGA to version 1.4.3 or later.
What type of attack is associated with CVE-2024-23820?
CVE-2024-23820 is associated with a denial of service (DoS) attack.
Which versions of OpenFGA are affected by CVE-2024-23820?
CVE-2024-23820 affects all versions of OpenFGA prior to 1.4.3.
What happens if CVE-2024-23820 is exploited?
If CVE-2024-23820 is exploited, it may lead to an 'out of memory' error, crashing the OpenFGA server.