x/vulndb: potential Go vuln in github.com/authzed/spicedb: GHSA-grjv-gjgr-66g2

[GoVulnBot]

Advisory GHSA-grjv-gjgr-66g2 references a vulnerability in the following Go modules:

Module
github.com/authzed/spicedb

Description:

Background

Use of an exclusion under an arrow that has multiple resources may resolve to
NO_PERMISSION when permission is expected.

For example, given this schema:

definition folder { relation member: user relation banned: user permission view
= member - banned }

definition resource { relation folder: folder permission view = folder->view }

If the resource exists under multiple folders and the user has access to view
more than a single folder, SpiceDB may report the user does not have access due
to a failure in the exclusion dispatcher to request tha...

References:

• ADVISORY: GHSA-grjv-gjgr-66g2
• ADVISORY: GHSA-grjv-gjgr-66g2
• FIX: authzed/spicedb@ecef31d

Cross references:

• Module github.com/authzed/spicedb appears in issue x/vulndb: potential Go vuln in github.com/authzed/spicedb: CVE-2022-21646 #295 EFFECTIVELY_PRIVATE
• Module github.com/authzed/spicedb appears in issue x/vulndb: potential Go vuln in github.com/authzed/spicedb: GHSA-cjr9-mr35-7xh6 #1723 EFFECTIVELY_PRIVATE
• Module github.com/authzed/spicedb appears in issue x/vulndb: potential Go vuln in github.com/authzed/spicedb: CVE-2023-35930 #1871 EFFECTIVELY_PRIVATE
• Module github.com/authzed/spicedb appears in issue x/vulndb: potential Go vuln in github.com/authzed/spicedb: CVE-2023-46255 #2166 EFFECTIVELY_PRIVATE
• Module github.com/authzed/spicedb appears in issue x/vulndb: potential Go vuln in github.com/authzed/spicedb: CVE-2024-27101 #2597
• Module github.com/authzed/spicedb appears in issue x/vulndb: potential Go vuln in github.com/authzed/spicedb: GHSA-j85q-46hg-36p2 #2716

See doc/triage.md for instructions on how to triage this report.

id: GO-ID-PENDING
modules:
    - module: github.com/authzed/spicedb
      versions:
        - fixed: 1.33.1
      vulnerable_at: 1.33.0
      packages:
        - package: github.com/authzed/spicedb
summary: SpiceDB exclusions can result in no permission returned when permission expected in github.com/authzed/spicedb
ghsas:
    - GHSA-grjv-gjgr-66g2
references:
    - advisory: https://github.com/advisories/GHSA-grjv-gjgr-66g2
    - advisory: https://github.com/authzed/spicedb/security/advisories/GHSA-grjv-gjgr-66g2
    - fix: https://github.com/authzed/spicedb/commit/ecef31d2b266fde17eb2c3415e2ec4ceff96fbeb
source:
    id: GHSA-grjv-gjgr-66g2
    created: 2024-06-20T17:01:17.528606568Z
review_status: UNREVIEWED

[gopherbot]

Change https://go.dev/cl/594901 mentions this issue: data/reports: add 18 unreviewed reports

[gopherbot]

Change https://go.dev/cl/595636 mentions this issue: data/reports: add 15 unreviewed reports

[gopherbot]

Change https://go.dev/cl/606359 mentions this issue: data/reports: regenerate 50 reports