Upstream information
Description
SpiceDB is an open source database for scalably storing and querying fine-grained authorization data. Starting in version 1.35.0 and prior to version 1.37.1, clients that have enabled `LookupResources2` and have caveats in the evaluation path for their requests can return a permissionship of `CONDITIONAL` with context marked as missing, even then the context was supplied. LookupResources2 is the new default in SpiceDB 1.37.0 and has been opt-in since SpiceDB 1.35.0. The bug is patched as part of SpiceDB 1.37.1. As a workaround, disable LookupResources2 via the `--enable-experimental-lookup-resources` flag by setting it to `false`.SUSE information
Overall state of this security issue: Resolved
This issue is currently not rated by SUSE as it is not affecting the SUSE Enterprise products.
| CNA (GitHub) | National Vulnerability Database | |
|---|---|---|
| Base Score | 2 | 2.4 |
| Vector | CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:N/A:N | CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:N/A:N |
| Attack Vector | Network | Network |
| Attack Complexity | High | Low |
| Privileges Required | High | High |
| User Interaction | Required | Required |
| Scope | Unchanged | Unchanged |
| Confidentiality Impact | Low | Low |
| Integrity Impact | None | None |
| Availability Impact | None | None |
| CVSSv3 Version | 3.1 | 3.1 |
SUSE Security Advisories:
- SUSE-SU-2024:3911-1, published 2024-11-05T07:45:06Z
- openSUSE-SU-2024:0350-1, published Tue Nov 5 22:50:01 2024
- openSUSE-SU-2024:14447-1, published Sat Nov 2 18:49:02 2024
List of released packages
| Product(s) | Fixed package version(s) | References |
|---|---|---|
| SUSE Linux Enterprise Module for Package Hub 15 SP5 |
| Patchnames: SUSE-SLE-Module-Packagehub-Subpackages-15-SP5-2024-3911 |
| SUSE Linux Enterprise Module for Package Hub 15 SP6 |
| Patchnames: SUSE-SLE-Module-Packagehub-Subpackages-15-SP6-2024-3911 |
| SUSE Package Hub 12 |
| Patchnames: openSUSE-2024-350 |
| openSUSE Leap 15.5 |
| Patchnames: openSUSE-SLE-15.5-2024-3911 |
| openSUSE Leap 15.6 |
| Patchnames: openSUSE-SLE-15.6-2024-3911 |
| openSUSE Tumbleweed |
| Patchnames: openSUSE-Tumbleweed-2024-14447 |
SUSE Timeline for this CVE
CVE page created: Tue Oct 15 00:00:12 2024CVE page last modified: Wed Nov 6 00:57:00 2024