Fastapi OPA is an opensource fastapi middleware which includes auth flow. HTTP `OPTIONS` requests are always allowed by `OpaMiddleware`, even when they lack authentication, and are passed through directly to the application. `OpaMiddleware` allows all HTTP `OPTIONS` requests without evaluating it against any policy. If an application provides different responses to HTTP `OPTIONS` requests based on an entity existing (such as to indicate whether an entity is writable on a system level), an unauthenticated attacker could discover which entities exist within an application. This issue has been addressed in release version 2.0.1. All users are advised to upgrade. There are no known workarounds for this vulnerability.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Fastapi OPA is an opensource fastapi middleware which includes auth flow. HTTP `OPTIONS` requests are     always allowed by `OpaMiddleware`, even when they lack authentication, and are passed through directly to     the application. `OpaMiddleware` allows all HTTP `OPTIONS` requests without evaluating it against any     policy. If an application provides different responses to HTTP `OPTIONS` requests based on an entity     existing (such as to indicate whether an entity is writable on a system level), an unauthenticated     attacker could discover which entities exist within an application. This issue has been addressed in     release version 2.0.1. All users are advised to upgrade. There are no known workarounds for this     vulnerability. (CVE-2024-40627)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Fastapi OPA is an opensource fastapi middleware which includes auth flow. HTTP `OPTIONS` requests are
    always allowed by `OpaMiddleware`, even when they lack authentication, and are passed through directly to
    the application. `OpaMiddleware` allows all HTTP `OPTIONS` requests without evaluating it against any
    policy. If an application provides different responses to HTTP `OPTIONS` requests based on an entity
    existing (such as to indicate whether an entity is writable on a system level), an unauthenticated
    attacker could discover which entities exist within an application. This issue has been addressed in
    release version 2.0.1. All users are advised to upgrade. There are no known workarounds for this
    vulnerability. (CVE-2024-40627)

ID	Name	Product	Family	Type	Severity
261951	Linux Distros Unpatched Vulnerability : CVE-2024-40627	Nessus	Misc.	Local	medium
410789	SCA: security update for fastapi-opa (GHSA-5f5c-8rvc-j8wf)	Tenable Cloud Security	SCA Checks	Local	medium
410789	SCA: security update for fastapi-opa (GHSA-5f5c-8rvc-j8wf)	Tenable Self-Hosted Container Security	SCA Checks	Local	medium

Detections

Analytics

CVE-2024-40627

medium

Tenable Plugins

medium

medium

medium