Publish GHSA-27vq-hv74-7cqp

2026-05-22 18:04:22 -07:00 · 2024-12-16 17:40:46 +00:00
parent 4757d73eef
commit 3bb2aebf6e
1 changed files with 78 additions and 0 deletions
@@ -0,0 +1,78 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-27vq-hv74-7cqp",
+  "modified": "2024-12-16T17:38:53Z",
+  "published": "2024-12-16T17:38:53Z",
+  "aliases": [],
+  "summary": "SurrealDB has Silent Failure to Overwrite Table Definition of Relation Type",
+  "details": "The `OVERWRITE` clause of the `DEFINE TABLE` statement would fail to overwrite data for tables that were defined with `TYPE RELATION`. Since table definitions include the `PERMISSIONS` clause, this failure would result in permissions not being overwritten as a result, which may potentially lead users to believe they have changed the table permissions when they have not.\n\n### Impact\n\nIf a user attempted to update table permissions of a table defined with `TYPE RELATION` using `DEFINE TABLE ... OVERWRITE`, permissions for the table would not be changed. This may allow a client that is authorized to run queries in a SurrealDB server to access certain data in that specific table that they were not intended to be able to access after the specified change in permissions.\n\n### Patches\n\nThe `DEFINE TABLE` statement has been updated to appropriately overwrite data for tables defined with `TYPE RELATION`.\n\n- Version 2.1.3 and later are not affected by this issue.\n\n### Workarounds\n\nUsers of tables with `TYPE RELATION` that may have been modified using the `OVERWRITE` clause in order to update permissions are advised to verify that the intended permissions are in place using the `INFO FOR DB` statement. Affected users who are unable to update and require updating permissions in a table with `TYPE RELATION` will be required to remove the table and define it from scratch with the intended permissions. Data can be preserved by backing it up to a temporary table.\n\n### References\n\n- #5260",
+  "severity": [
+    {
+      "type": "CVSS_V4",
+      "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N"
+    }
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "crates.io",
+        "name": "surrealdb"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "2.0.0"
+            },
+            {
+              "fixed": "2.1.3"
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "package": {
+        "ecosystem": "crates.io",
+        "name": "surrealdb-core"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "2.0.0"
+            },
+            {
+              "fixed": "2.1.3"
+            }
+          ]
+        }
+      ]
+    }
+  ],
+  "references": [
+    {
+      "type": "WEB",
+      "url": "https://github.com/surrealdb/surrealdb/security/advisories/GHSA-27vq-hv74-7cqp"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/surrealdb/surrealdb/pull/5260"
+    },
+    {
+      "type": "PACKAGE",
+      "url": "https://github.com/surrealdb/surrealdb"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-732"
+    ],
+    "severity": "LOW",
+    "github_reviewed": true,
+    "github_reviewed_at": "2024-12-16T17:38:53Z",
+    "nvd_published_at": null
+  }
+}