x/vulndb: potential Go vuln in github.com/openfga/openfga: CVE-2023-35933

[GoVulnBot]

CVE-2023-35933 references github.com/openfga/openfga, which may be a Go module.

Description:
OPenFGA is an open source authorization/permission engine built for developers. OpenFGA versions v1.1.0 and prior are vulnerable to a DoS attack when Check and ListObjects calls are executed against authorization models that contain circular relationship definitions. Users are affected by this vulnerability if they are using OpenFGA v1.1.0 or earlier, and if you are executing Check or ListObjects calls against a vulnerable authorization model. Users are advised to upgrade to version 1.1.1. There are no known workarounds for this vulnerability. Users that do not have circular relationships in their models are not affected.

References:

• NIST: https://nvd.nist.gov/vuln/detail/CVE-2023-35933
• JSON: https://github.com/CVEProject/cvelist/tree/5ecf69745f696849e5c7faf5fb8aae6e2b12cabc/2023/35xxx/CVE-2023-35933.json
• advisory: GHSA-hr9r-8phq-5x8j
• fix: openfga/openfga@087ce39
• web: https://openfga.dev/api/service#/Relationship%20Queries/Check
• web: https://openfga.dev/api/service#/Relationship%20Queries/ListObjects
• Imported by: https://pkg.go.dev/github.com/openfga/openfga?tab=importedby

Cross references:

• Module github.com/openfga/openfga appears in issue x/vulndb: potential Go vuln in github.com/openfga/openfga: CVE-2022-39340 #1079 EFFECTIVELY_PRIVATE
• Module github.com/openfga/openfga appears in issue x/vulndb: potential Go vuln in github.com/openfga/openfga: CVE-2022-39341 #1080 EFFECTIVELY_PRIVATE
• Module github.com/openfga/openfga appears in issue x/vulndb: potential Go vuln in github.com/openfga/openfga: CVE-2022-39342 #1081 EFFECTIVELY_PRIVATE
• Module github.com/openfga/openfga appears in issue x/vulndb: potential Go vuln in github.com/openfga/openfga: CVE-2022-39352 #1099 EFFECTIVELY_PRIVATE
• Module github.com/openfga/openfga appears in issue x/vulndb: potential Go vuln in github.com/openfga/openfga: CVE-2022-23542 #1179 EFFECTIVELY_PRIVATE

See doc/triage.md for instructions on how to triage this report.

modules:
    - module: github.com/openfga/openfga
      packages:
        - package: openfga
description: |-
    OPenFGA is an open source authorization/permission engine built for developers.
    OpenFGA versions v1.1.0 and prior are vulnerable to a DoS attack when Check and
    ListObjects calls are executed against authorization models that contain
    circular relationship definitions. Users are affected by this vulnerability if
    they are using OpenFGA v1.1.0 or earlier, and if you are executing `Check` or
    `ListObjects` calls against a vulnerable authorization model. Users are advised
    to upgrade to version 1.1.1. There are no known workarounds for this
    vulnerability. Users that do not have circular relationships in their models are
    not affected.
cves:
    - CVE-2023-35933
references:
    - advisory: https://github.com/openfga/openfga/security/advisories/GHSA-hr9r-8phq-5x8j
    - fix: https://github.com/openfga/openfga/commit/087ce392595f3c319ab3028b5089118ea4063452
    - web: https://openfga.dev/api/service#/Relationship%20Queries/Check
    - web: https://openfga.dev/api/service#/Relationship%20Queries/ListObjects

[gopherbot]

Change https://go.dev/cl/506760 mentions this issue: data/reports: add GO-2023-1872.yaml