netbird/advisory-database
0
0
Fork 0
mirror of https://github.com/netbirdio/advisory-database.git synced 2026-05-22 18:04:22 -07:00
Code Issues Packages Projects Releases Wiki Activity

Publish GHSA-27vq-hv74-7cqp

Browse Source
This commit is contained in:
advisory-database[bot]
2024-12-18 17:19:48 +00:00
parent 9708808ef6
commit ca0178f3d0
1 changed files with 8 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
advisories/github-reviewed/2024/12/GHSA-27vq-hv74-7cqp/GHSA-27vq-hv74-7cqp.json
+8 -4
View File
@@ -1,11 +1,11 @@
{
"schema_version": "1.4.0",
"id": "GHSA-27vq-hv74-7cqp",
"modified": "2024-12-16T17:38:53Z",
"modified": "2024-12-18T17:18:19Z",
"published": "2024-12-16T17:38:53Z",
"aliases": [],
"summary": "SurrealDB has Silent Failure to Overwrite Table Definition of Relation Type",
"details": "The `OVERWRITE` clause of the `DEFINE TABLE` statement would fail to overwrite data for tables that were defined with `TYPE RELATION`. Since table definitions include the `PERMISSIONS` clause, this failure would result in permissions not being overwritten as a result, which may potentially lead users to believe they have changed the table permissions when they have not.\n\n### Impact\n\nIf a user attempted to update table permissions of a table defined with `TYPE RELATION` using `DEFINE TABLE ... OVERWRITE`, permissions for the table would not be changed. This may allow a client that is authorized to run queries in a SurrealDB server to access certain data in that specific table that they were not intended to be able to access after the specified change in permissions.\n\n### Patches\n\nThe `DEFINE TABLE` statement has been updated to appropriately overwrite data for tables defined with `TYPE RELATION`.\n\n- Version 2.1.3 and later are not affected by this issue.\n\n### Workarounds\n\nUsers of tables with `TYPE RELATION` that may have been modified using the `OVERWRITE` clause in order to update permissions are advised to verify that the intended permissions are in place using the `INFO FOR DB` statement. Affected users who are unable to update and require updating permissions in a table with `TYPE RELATION` will be required to remove the table and define it from scratch with the intended permissions. Data can be preserved by backing it up to a temporary table.\n\n### References\n\n- #5260",
"details": "The `OVERWRITE` clause of the `DEFINE TABLE` statement would fail to overwrite data for tables that were defined with `TYPE RELATION`. Since table definitions include the `PERMISSIONS` clause, this failure would result in permissions not being overwritten as a result, which may potentially lead users to believe they have changed the table permissions when they have not.\n\n### Impact\n\nIf a user attempted to update table permissions of a table defined with `TYPE RELATION` using `DEFINE TABLE ... OVERWRITE`, permissions for the table would not be changed. This may allow a client that is authorized to run queries in a SurrealDB server to access certain data in that specific table that they were not intended to be able to access after the specified change in permissions.\n\n### Patches\n\nThe `DEFINE TABLE` statement has been updated to appropriately overwrite data for tables defined with `TYPE RELATION`.\n\n- Version 2.1.4 and later are not affected by this issue.\n\n### Workarounds\n\nUsers of tables with `TYPE RELATION` that may have been modified using the `OVERWRITE` clause in order to update permissions are advised to verify that the intended permissions are in place using the `INFO FOR DB` statement. Affected users who are unable to update and require updating permissions in a table with `TYPE RELATION` will be required to remove the table and define it from scratch with the intended permissions. Data can be preserved by backing it up to a temporary table.\n\n### References\n\n- #5260",
"severity": [
{
"type": "CVSS_V4",
@@ -26,7 +26,7 @@
"introduced": "2.0.0"
},
{
"fixed": "2.1.3"
"fixed": "2.1.4"
}
]
}
@@ -45,7 +45,7 @@
"introduced": "2.0.0"
},
{
"fixed": "2.1.3"
"fixed": "2.1.4"
}
]
}
@@ -61,6 +61,10 @@
"type": "WEB",
"url": "https://github.com/surrealdb/surrealdb/pull/5260"
},
{
"type": "WEB",
"url": "https://github.com/surrealdb/surrealdb/commit/2f9a58f830c24f107b4783da1f0704a502bc7734"
},
{
"type": "PACKAGE",
"url": "https://github.com/surrealdb/surrealdb"