From ca0178f3d015a6d9d752738171fbbe663a1241ea Mon Sep 17 00:00:00 2001
From: "advisory-database[bot]"
 <45398580+advisory-database[bot]@users.noreply.github.com>
Date: Wed, 18 Dec 2024 17:19:48 +0000
Subject: [PATCH] Publish GHSA-27vq-hv74-7cqp

---
 .../12/GHSA-27vq-hv74-7cqp/GHSA-27vq-hv74-7cqp.json  | 12 ++++++++----
 1 file changed, 8 insertions(+), 4 deletions(-)

diff --git a/advisories/github-reviewed/2024/12/GHSA-27vq-hv74-7cqp/GHSA-27vq-hv74-7cqp.json b/advisories/github-reviewed/2024/12/GHSA-27vq-hv74-7cqp/GHSA-27vq-hv74-7cqp.json
index f70d8c0bb63..a78f9bfb4e2 100644
--- a/advisories/github-reviewed/2024/12/GHSA-27vq-hv74-7cqp/GHSA-27vq-hv74-7cqp.json
+++ b/advisories/github-reviewed/2024/12/GHSA-27vq-hv74-7cqp/GHSA-27vq-hv74-7cqp.json
@@ -1,11 +1,11 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-27vq-hv74-7cqp",
-  "modified": "2024-12-16T17:38:53Z",
+  "modified": "2024-12-18T17:18:19Z",
   "published": "2024-12-16T17:38:53Z",
   "aliases": [],
   "summary": "SurrealDB has Silent Failure to Overwrite Table Definition of Relation Type",
-  "details": "The `OVERWRITE` clause of the `DEFINE TABLE` statement would fail to overwrite data for tables that were defined with `TYPE RELATION`. Since table definitions include the `PERMISSIONS` clause, this failure would result in permissions not being overwritten as a result, which may potentially lead users to believe they have changed the table permissions when they have not.\n\n### Impact\n\nIf a user attempted to update table permissions of a table defined with `TYPE RELATION` using `DEFINE TABLE ... OVERWRITE`, permissions for the table would not be changed. This may allow a client that is authorized to run queries in a SurrealDB server to access certain data in that specific table that they were not intended to be able to access after the specified change in permissions.\n\n### Patches\n\nThe `DEFINE TABLE` statement has been updated to appropriately overwrite data for tables defined with `TYPE RELATION`.\n\n- Version 2.1.3 and later are not affected by this issue.\n\n### Workarounds\n\nUsers of tables with `TYPE RELATION` that may have been modified using the `OVERWRITE` clause in order to update permissions are advised to verify that the intended permissions are in place using the `INFO FOR DB` statement. Affected users who are unable to update and require updating permissions in a table with `TYPE RELATION` will be required to remove the table and define it from scratch with the intended permissions. Data can be preserved by backing it up to a temporary table.\n\n### References\n\n- #5260",
+  "details": "The `OVERWRITE` clause of the `DEFINE TABLE` statement would fail to overwrite data for tables that were defined with `TYPE RELATION`. Since table definitions include the `PERMISSIONS` clause, this failure would result in permissions not being overwritten as a result, which may potentially lead users to believe they have changed the table permissions when they have not.\n\n### Impact\n\nIf a user attempted to update table permissions of a table defined with `TYPE RELATION` using `DEFINE TABLE ... OVERWRITE`, permissions for the table would not be changed. This may allow a client that is authorized to run queries in a SurrealDB server to access certain data in that specific table that they were not intended to be able to access after the specified change in permissions.\n\n### Patches\n\nThe `DEFINE TABLE` statement has been updated to appropriately overwrite data for tables defined with `TYPE RELATION`.\n\n- Version 2.1.4 and later are not affected by this issue.\n\n### Workarounds\n\nUsers of tables with `TYPE RELATION` that may have been modified using the `OVERWRITE` clause in order to update permissions are advised to verify that the intended permissions are in place using the `INFO FOR DB` statement. Affected users who are unable to update and require updating permissions in a table with `TYPE RELATION` will be required to remove the table and define it from scratch with the intended permissions. Data can be preserved by backing it up to a temporary table.\n\n### References\n\n- #5260",
   "severity": [
     {
       "type": "CVSS_V4",
@@ -26,7 +26,7 @@
               "introduced": "2.0.0"
             },
             {
-              "fixed": "2.1.3"
+              "fixed": "2.1.4"
             }
           ]
         }
@@ -45,7 +45,7 @@
               "introduced": "2.0.0"
             },
             {
-              "fixed": "2.1.3"
+              "fixed": "2.1.4"
             }
           ]
         }
@@ -61,6 +61,10 @@
       "type": "WEB",
       "url": "https://github.com/surrealdb/surrealdb/pull/5260"
     },
+    {
+      "type": "WEB",
+      "url": "https://github.com/surrealdb/surrealdb/commit/2f9a58f830c24f107b4783da1f0704a502bc7734"
+    },
     {
       "type": "PACKAGE",
       "url": "https://github.com/surrealdb/surrealdb"