CVE-2022-36085: Protection Mechanism Failure
Open Policy Agent (OPA) is an open source, general-purpose policy engine. The Rego compiler provides a (deprecated) WithUnsafeBuiltins function, which allows users to provide a set of built-in functions that should be deemed unsafe by the compiler if encountered in the policy compilation stage. A bypass of this protection has been found, where the use of the with keyword to mock such a built-in function (a feature introduced in OPA v0.40.0), is not taken into account by WithUnsafeBuiltins. Multiple conditions need to be met in order to create an adverse effect. Version 0.43.1 contains a patch for this issue. As a workaround, avoid using the WithUnsafeBuiltins function and use the capabilities feature instead.
References
- github.com/advisories/GHSA-f524-rf33-2jjr
- github.com/open-policy-agent/opa/commit/25a597bc3f4985162e7f65f9c36599f4f8f55823
- github.com/open-policy-agent/opa/commit/3e8c754ed007b22393cf65e48751ad9f6457fee8
- github.com/open-policy-agent/opa/pull/4540
- github.com/open-policy-agent/opa/pull/4616
- github.com/open-policy-agent/opa/releases/tag/v0.43.1
- github.com/open-policy-agent/opa/security/advisories/GHSA-f524-rf33-2jjr
- nvd.nist.gov/vuln/detail/CVE-2022-36085
Code Behaviors & Features
Detect and mitigate CVE-2022-36085 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →