x/vulndb: potential Go vuln in github.com/openfga/openfga: CVE-2022-39341

[GoVulnBot]

CVE-2022-39341 references github.com/openfga/openfga, which may be a Go module.

Description:
OpenFGA is an authorization/permission engine. Versions prior to version 0.2.4 are vulnerable to authorization bypass under certain conditions. Users who have wildcard (*) defined on tupleset relations in their authorization model are vulnerable. Version 0.2.4 contains a patch for this issue.

References:

• NIST: https://nvd.nist.gov/vuln/detail/CVE-2022-39341
• JSON: https://github.com/CVEProject/cvelist/tree/640265a83f2e25c341aab4c3f4d3b9354b89c1d9/2022/39xxx/CVE-2022-39341.json
• web: https://github.com/openfga/openfga/releases/tag/v0.2.4
• web: GHSA-vj4m-83m8-xpw5
• fix: openfga/openfga@b466769
• Imported by: https://pkg.go.dev/github.com/openfga/openfga?tab=importedby

See doc/triage.md for instructions on how to triage this report.

modules:
  - module: github.com/openfga/openfga
    packages:
      - package: openfga
description: |
    OpenFGA is an authorization/permission engine. Versions prior to version 0.2.4 are vulnerable to authorization bypass under certain conditions. Users who have wildcard (`*`) defined on tupleset relations in their authorization model are vulnerable. Version 0.2.4 contains a patch for this issue.
cves:
  - CVE-2022-39341
references:
  - web: https://github.com/openfga/openfga/releases/tag/v0.2.4
  - web: https://github.com/openfga/openfga/security/advisories/GHSA-vj4m-83m8-xpw5
  - fix: https://github.com/openfga/openfga/commit/b466769cc100b2065047786578718d313f52695b

[gopherbot]

Change https://go.dev/cl/446358 mentions this issue: data/excluded: add GO-2022-1080.yaml

[gopherbot]

Change https://go.dev/cl/592774 mentions this issue: data/reports: unexclude 50 reports

[gopherbot]

Change https://go.dev/cl/607231 mentions this issue: data/reports: unexclude 20 reports (29)