x/vulndb: potential Go vuln in github.com/authzed/spicedb: CVE-2024-38361

[GoVulnBot]

Advisory CVE-2024-38361 references a vulnerability in the following Go modules:

Module
github.com/authzed/spicedb

Description:
Spicedb is an Open Source, Google Zanzibar-inspired permissions database to
enable fine-grained authorization for customer applications. Use of an exclusion
under an arrow that has multiple resources may resolve to NO_PERMISSION when
permission is expected. If the resource exists under multiple folders and the
user has access to view more than a single folder, SpiceDB may report the user
does not have access due to a failure in the exclusion dispatcher to request
that all the folders in which the user is a member be returned. Permission is
returned as NO_PERMISSION when PERMISSION is...

References:

• ADVISORY: https://nvd.nist.gov/vuln/detail/CVE-2024-38361
• FIX: authzed/spicedb@ecef31d
• WEB: GHSA-grjv-gjgr-66g2

Cross references:

• Module github.com/authzed/spicedb appears in issue x/vulndb: potential Go vuln in github.com/authzed/spicedb: CVE-2022-21646 #295 EFFECTIVELY_PRIVATE
• Module github.com/authzed/spicedb appears in issue x/vulndb: potential Go vuln in github.com/authzed/spicedb: GHSA-cjr9-mr35-7xh6 #1723 EFFECTIVELY_PRIVATE
• Module github.com/authzed/spicedb appears in issue x/vulndb: potential Go vuln in github.com/authzed/spicedb: CVE-2023-35930 #1871 EFFECTIVELY_PRIVATE
• Module github.com/authzed/spicedb appears in issue x/vulndb: potential Go vuln in github.com/authzed/spicedb: CVE-2023-46255 #2166 EFFECTIVELY_PRIVATE
• Module github.com/authzed/spicedb appears in issue x/vulndb: potential Go vuln in github.com/authzed/spicedb: CVE-2024-27101 #2597
• Module github.com/authzed/spicedb appears in issue x/vulndb: potential Go vuln in github.com/authzed/spicedb: GHSA-j85q-46hg-36p2 #2716

See doc/triage.md for instructions on how to triage this report.

id: GO-ID-PENDING
modules:
    - module: github.com/authzed/spicedb
      vulnerable_at: 1.33.1
      packages:
        - package: spicedb
summary: CVE-2024-38361 in github.com/authzed/spicedb
cves:
    - CVE-2024-38361
references:
    - advisory: https://nvd.nist.gov/vuln/detail/CVE-2024-38361
    - fix: https://github.com/authzed/spicedb/commit/ecef31d2b266fde17eb2c3415e2ec4ceff96fbeb
    - web: https://github.com/authzed/spicedb/security/advisories/GHSA-grjv-gjgr-66g2
source:
    id: CVE-2024-38361
    created: 2024-06-21T00:01:15.62209939Z
review_status: UNREVIEWED

[gopherbot]

Change https://go.dev/cl/594901 mentions this issue: data/reports: add 18 unreviewed reports

[tatianab]

Duplicate of #2939