Headline
CVE-2023-35930: LookupResources may return partial results in v1.22.0
SpiceDB is an open source, Google Zanzibar-inspired, database system for creating and managing security-critical application permissions. Any user making a negative authorization decision based on the results of a LookupResources request with 1.22.0 is affected. For example, using LookupResources to find a list of resources to allow access to be okay: some subjects that should have access to a resource may not. But if using LookupResources to find a list of banned resources instead, then some users that shouldn’t have access may. Generally, LookupResources is not and should not be to gate access in this way - that’s what the Check API is for. Additionally, version 1.22.0 has included a warning about this bug since its initial release. Users are advised to upgrade to version 1.22.2. Users unable to upgrade should avoid using LookupResources for negative authorization decisions.
Impact
Any user making a negative authorization decision based on the results of a LookupResources request with 1.22.0 is affected.
For example, using LookupResources to find a list of resources to allow access to be okay: some subjects that should have access to a resource may not. But if using LookupResources to find a list of banned resources instead, then some users that shouldn’t have access may.
Generally, LookupResources is not and should not be to gate access in this way - that’s what the Check API is for. Additionally, version 1.22.0 has included a warning about this bug since its initial release.
Workarounds
Avoid using LookupResources for negative authorization decisions if using 1.22.0.
Patches
The only affected release is v1.22.0, and it is patched in v1.22.2 (there is no v1.22.1 release, though there is a git tag).
References
- #1397
For more information
If you have any questions or comments about this advisory:
- Open an issue in SpiceDB
- Ask a question in the SpiceDB Discord
Related news
### Impact Any user making a negative authorization decision based on the results of a LookupResources request with 1.22.0 is affected. For example, using `LookupResources` to find a list of resources to allow access to be okay: some subjects that should have access to a resource may not. But if using `LookupResources` to find a list of banned resources instead, then some users that shouldn't have access may. Generally, `LookupResources` is not and should not be to gate access in this way - that's what the `Check` API is for. Additionally, version 1.22.0 has included a warning about this bug since its initial release. ### Workarounds Avoid using `LookupResources` for negative authorization decisions if using `1.22.0`. ### Patches The only affected release is [v1.22.0](https://github.com/authzed/spicedb/releases/tag/v1.22.0), and it is patched in [v1.22.2](https://github.com/authzed/spicedb/releases/tag/v1.22.2) (there is no v1.22.1 release, though there is a git tag). ### Referen...