CVE-2024-38361: SpiceDB exclusions can result in no permission returned when permission expected

June 20, 2024 (updated November 18, 2024)

Permission is returned as NO_PERMISSION when PERMISSION is expected on the CheckPermission API.

References

github.com/advisories/GHSA-grjv-gjgr-66g2
github.com/authzed/spicedb
github.com/authzed/spicedb/commit/ecef31d2b266fde17eb2c3415e2ec4ceff96fbeb
github.com/authzed/spicedb/security/advisories/GHSA-grjv-gjgr-66g2
nvd.nist.gov/vuln/detail/CVE-2024-38361

Code Behaviors & Features

Detect and mitigate CVE-2024-38361 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →