netbird/advisory-database
0
0
Fork 0
mirror of https://github.com/netbirdio/advisory-database.git synced 2026-05-22 18:04:22 -07:00
Code Issues Packages Projects Releases Wiki Activity

Publish GHSA-grjv-gjgr-66g2

Browse Source
This commit is contained in:
advisory-database[bot]
2024-06-20 17:31:06 +00:00
parent 8a4f2ec53a
commit f96f05229a
1 changed files with 2 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
advisories/github-reviewed/2024/06/GHSA-grjv-gjgr-66g2/GHSA-grjv-gjgr-66g2.json
+2 -2
View File
@@ -1,10 +1,10 @@
{
"schema_version": "1.4.0",
"id": "GHSA-grjv-gjgr-66g2",
"modified": "2024-06-20T16:24:01Z",
"modified": "2024-06-20T17:29:39Z",
"published": "2024-06-20T16:24:01Z",
"aliases": [
"CVE-2024-38361"
],
"summary": "SpiceDB exclusions can result in no permission returned when permission expected",
"details": "### Background\n\nUse of an exclusion under an arrow that has multiple resources may resolve to `NO_PERMISSION` when permission is expected.\n\nFor example, given this schema:\n\n```zed\ndefinition user {}\n\ndefinition folder {\n relation member: user\n relation banned: user\n permission view = member - banned\n}\n\ndefinition resource {\n relation folder: folder\n permission view = folder->view\n}\n```\n\nIf the resource exists under *multiple* folders and the user has access to view more than a single folder, SpiceDB may report the user does not have access due to a failure in the exclusion dispatcher to request that *all* the folders in which the user is a member be returned\n\n### Impact\n\nPermission is returned as `NO_PERMISSION` when `PERMISSION` is expected on the `CheckPermission` API.\n\n### Workarounds\n\nNone\n",