CVE-2023-43645
CVSS 3.1 Score 5.9 of 10 (medium)
Details
Summary
CVE-2023-43645 is a denial-of-service vulnerability affecting OpenFGA, an authorization engine. The issue arises when the engine encounters circular relationship definitions in certain authorization models. When specific checks are made against these models, the server can exhaust resources and crash. The recommended solution is upgrading to OpenFGA v1.3.2 and updating any problematic models. Models with cyclic definitions or a relation in its evaluation path will no longer be evaluated on v1.3.2 and above, causing checks and queries to return errors instead. Users with models free of cycles are not impacted.
Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.
Affected Products
- OpenFGA
Affected Vendors
- Openfga
Advisories, Assessments, and Mitigations
Prioritize, Pinpoint, and Act to Prevent Vulnerability Exploits with Recorded Future
- Gain complete coverage of your cyber, third party, and physical attack surface
- Proactively mitigate threats before they turn into costly attacks
- Make fast, effective, data-driven decisions