CVE-2024-8260: OPA for Windows has an SMB force-authentication vulnerability
(updated )
A SMB force-authentication vulnerability exists in all versions of OPA for Windows prior to v0.68.0. The vulnerability exists because of improper input validation, allowing a user to pass an arbitrary SMB share instead of a Rego file as an argument to OPA CLI or to one of the OPA Go library’s functions.
References
- github.com/advisories/GHSA-c77r-fh37-x2px
- github.com/open-policy-agent/opa
- github.com/open-policy-agent/opa/commit/10f4d553e6bb6ae9c69611ecdd9a77dda857070e
- github.com/open-policy-agent/opa/releases/tag/v0.68.0
- nvd.nist.gov/vuln/detail/CVE-2024-8260
- pkg.go.dev/vuln/GO-2024-3141
- www.tenable.com/security/research/tra-2024-36
Code Behaviors & Features
Detect and mitigate CVE-2024-8260 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →