Affected versions:

• Rust <1.1.0
• Java: <1.1.0
• Go: <1.0.0

Rules of the format operation($ambient, #read) <- operation($ambient, $any) provided by blocks other than the authority block could be used to generate facts with the #authority or #ambient tags. This can result in elevation of privilege.

Upgrade immediately to non affected versions

This issue was reported by @svvac. Thanks a lot!

Affected versions:

• Rust <1.0.1
• Java: results in Null Pointer Exception in versions <1.1.0
• Go: not affected

Rules of the format operation($unbound, #read) <- operation($any1, $any2) could generate invalid facts containing variables, that would then confuse matching of other checks and make them succeed. This can result in elevation of privilege.

Upgrade immediately to non affected versions

This issue was reported by @svvac. Thanks a lot!