Detections
Analytics

SCA: security update for github.com/openfga/openfga (GHSA-2hm9-h873-pgqh)

medium Tenable Cloud Security Plugin ID 408941

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - OpenFGA is an authorization/permission engine built for developers and inspired by Google Zanzibar.
 OpenFGA is vulnerable to a denial of service attack when certain Check calls are executed against
 authorization models that contain circular relationship definitions. When the call is made, it's possible
 for the server to exhaust resources and die. Users are advised to upgrade to v1.3.2 and update any
 offending models. There are no known workarounds for this vulnerability. Note that for models which
 contained cycles or a relation definition that has the relation itself in its evaluation path, checks and
 queries that require evaluation will no longer be evaluated on v1.3.2+ and will return errors instead.
 Users who do not have cyclic models are unaffected. (CVE-2023-43645)

See Also

https://github.com/advisories/GHSA-2hm9-h873-pgqh

Plugin Details

Severity: Medium

ID: 408941

Version: Revision 1.8

Type: Local

Family: SCA Checks

Published: 1/23/2025

Updated: 6/1/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Low

Score: 3

Percentile: 23.51

Vendor

Vendor Severity: Medium

CVSS v2

Risk Factor: Medium

Base Score: 5.4

Temporal Score: 4

Vector: CVSS2#AV:N/AC:H/Au:N/C:N/I:N/A:C

CVSS Score Source: CVE-2023-43645

CVSS v3

Risk Factor: Medium

Base Score: 5.9

Temporal Score: 5.2

Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 9/28/2023

Vulnerability Publication Date: 9/26/2023

Reference Information

CVE: CVE-2023-43645

cwe: CWE-835