x/vulndb: potential Go vuln in github.com/openfga/openfga: CVE-2022-39352

[GoVulnBot]

CVE-2022-39352 references github.com/openfga/openfga, which may be a Go module.

Description:
OpenFGA is a high-performance authorization/permission engine inspired by Google Zanzibar. Versions prior to 0.2.5 are vulnerable to authorization bypass under certain conditions. You are affected by this vulnerability if you added a tuple with a wildcard (*) assigned to a tupleset relation (the right hand side of a ‘from’ statement). This issue has been patched in version v0.2.5. This update is not backward compatible with any authorization model that uses wildcard on a tupleset relation.

References:

• NIST: https://nvd.nist.gov/vuln/detail/CVE-2022-39352
• JSON: https://github.com/CVEProject/cvelist/tree/38ad9bdf52077505259bfc7298e3c8c1866c3258/2022/39xxx/CVE-2022-39352.json
• web: GHSA-3gfj-fxx4-f22w
• Imported by: https://pkg.go.dev/github.com/openfga/openfga?tab=importedby

See doc/triage.md for instructions on how to triage this report.

modules:
  - module: github.com/openfga/openfga
    packages:
      - package: openfga
description: |
    OpenFGA is a high-performance authorization/permission engine inspired by Google Zanzibar. Versions prior to 0.2.5 are vulnerable to authorization bypass under certain conditions. You are affected by this vulnerability if you added a tuple with a wildcard (*) assigned to a tupleset relation (the right hand side of a ‘from’ statement). This issue has been patched in version v0.2.5. This update is not backward compatible with any authorization model that uses wildcard on a tupleset relation.
cves:
  - CVE-2022-39352
references:
  - web: https://github.com/openfga/openfga/security/advisories/GHSA-3gfj-fxx4-f22w

[gopherbot]

Change https://go.dev/cl/448815 mentions this issue: data/excluded: add GO-2022-1099.yaml

[gopherbot]

Change https://go.dev/cl/592835 mentions this issue: data/reports: unexclude 50 reports

[gopherbot]

Change https://go.dev/cl/607231 mentions this issue: data/reports: unexclude 20 reports (29)