x/vulndb: potential Go vuln in github.com/openfga/openfga: CVE-2023-45810

[GoVulnBot]

CVE-2023-45810 references github.com/openfga/openfga, which may be a Go module.

Description:
OpenFGA is a flexible authorization/permission engine built for developers and inspired by Google Zanzibar. Affected versions of OpenFGA are vulnerable to a denial of service attack. When a number of ListObjects calls are executed, in some scenarios, those calls are not releasing resources even after a response has been sent, and given a sufficient call volume the service as a whole becomes unresponsive. This issue has been addressed in version 1.3.4 and the upgrade is considered backwards compatible. There are no known workarounds for this vulnerability.

References:

• NIST: https://nvd.nist.gov/vuln/detail/CVE-2023-45810
• JSON: https://github.com/CVEProject/cvelist/tree/27c23ec539a4420f0af2327f25f3817e3908308b/2023/45xxx/CVE-2023-45810.json
• advisory: GHSA-hr4f-6jh8-f2vq
• Imported by: https://pkg.go.dev/github.com/openfga/openfga?tab=importedby

Cross references:

• Module github.com/openfga/openfga appears in issue x/vulndb: potential Go vuln in github.com/openfga/openfga: CVE-2022-39340 #1079 EFFECTIVELY_PRIVATE
• Module github.com/openfga/openfga appears in issue x/vulndb: potential Go vuln in github.com/openfga/openfga: CVE-2022-39341 #1080 EFFECTIVELY_PRIVATE
• Module github.com/openfga/openfga appears in issue x/vulndb: potential Go vuln in github.com/openfga/openfga: CVE-2022-39342 #1081 EFFECTIVELY_PRIVATE
• Module github.com/openfga/openfga appears in issue x/vulndb: potential Go vuln in github.com/openfga/openfga: CVE-2022-39352 #1099 EFFECTIVELY_PRIVATE
• Module github.com/openfga/openfga appears in issue x/vulndb: potential Go vuln in github.com/openfga/openfga: CVE-2022-23542 #1179 EFFECTIVELY_PRIVATE
• Module github.com/openfga/openfga appears in issue x/vulndb: potential Go vuln in github.com/openfga/openfga: GHSA-jcf2-mxr2-gmqp #2028 EFFECTIVELY_PRIVATE
• Module github.com/openfga/openfga appears in issue x/vulndb: potential Go vuln in github.com/openfga/openfga: CVE-2023-43645 #2084 EFFECTIVELY_PRIVATE
• Module github.com/openfga/openfga appears in issue x/vulndb: potential Go vuln in github.com/openfga/openfga: CVE-2023-35933 #1872

See doc/triage.md for instructions on how to triage this report.

modules:
    - module: github.com/openfga/openfga
      vulnerable_at: 1.3.4
      packages:
        - package: openfga
cves:
    - CVE-2023-45810
references:
    - advisory: https://github.com/openfga/openfga/security/advisories/GHSA-hr4f-6jh8-f2vq

[gopherbot]

Change https://go.dev/cl/537395 mentions this issue: data/excluded: batch add 18 excluded reports

[gopherbot]

Change https://go.dev/cl/592763 mentions this issue: data/reports: unexclude 75 reports

[gopherbot]

Change https://go.dev/cl/606792 mentions this issue: data/reports: unexclude 20 reports (11)