Skip to main content

Encoding Error

CVE-2024-48909

Low
2.4/10

Summary

SpiceDB is an open source database for scalably storing and querying fine-grained authorization data. In github.com/authzed/spicedb package versions 1.35.0 through 1.37.0, clients that have enabled "LookupResources2" and have caveats in the evaluation path for their requests can return a permissionship of "CONDITIONAL" with context marked as missing, even then the context was supplied. "LookupResources2" is the new default in SpiceDB 1.37.0, and has been "opt-in" since SpiceDB 1.35.0. The bug was patched as part of SpiceDB 1.37.1. As a workaround, disable "LookupResources2" via the `--enable-experimental-lookup-resources` flag by setting it to `false`.

  • LOW
  • NETWORK
  • NONE
  • UNCHANGED
  • REQUIRED
  • HIGH
  • LOW
  • NONE

CWE-172 - Encoding Error

The software does not properly encode or decode the data, resulting in unexpected values.

References

Advisory Timeline

  • Published