CVE-2023-35930

SpiceDB is an open source, Google Zanzibar-inspired, database system for creating and managing security-critical application permissions. Any user making a negative authorization decision based on the results of a `LookupResources` request with 1.22.0 is affected. For example, using `LookupResources` to find a list of resources to allow access to be okay: some subjects that should have access to a resource may not. But if using `LookupResources` to find a list of banned resources instead, then some users that shouldn't have access may. Generally, `LookupResources` is not and should not be to gate access in this way - that's what the `Check` API is for. Additionally, version 1.22.0 has included a warning about this bug since its initial release. Users are advised to upgrade to version 1.22.2. Users unable to upgrade should avoid using `LookupResources` for negative authorization decisions.

SpiceDB is an open source, Google Zanzibar-inspired, database system for creating and managing security-critical application permissions. Any user making a negative authorization decision based on the results of a `LookupResources` request with 1.22.0 is affected. For example, using `LookupResources` to find a list of resources to allow access to be okay: some subjects that should have access to a resource may not. But if using `LookupResources` to find a list of banned resources instead, then some users that shouldn't have access may. Generally, `LookupResources` is not and should not be to gate access in this way - that's what the `Check` API is for. Additionally, version 1.22.0 has included a warning about this bug since its initial release. Users are advised to upgrade to version 1.22.2. Users unable to upgrade should avoid using `LookupResources` for negative authorization decisions.

SpiceDB's LookupResources may return partial results in github.com/authzed/spicedb

### Impact Any user making a negative authorization decision based on the results of a LookupResources request with 1.22.0 is affected. For example, using `LookupResources` to find a list of resources to allow access to be okay: some subjects that should have access to a resource may not. But if using `LookupResources` to find a list of banned resources instead, then some users that shouldn't have access may. Generally, `LookupResources` is not and should not be used to gate access in this way - that's what the `Check` API is for. Additionally, version 1.22.0 has included a warning about this bug since its initial release. ### Workarounds Avoid using `LookupResources` for negative authorization decisions if using `1.22.0`. ### Patches The only affected release is [v1.22.0](https://github.com/authzed/spicedb/releases/tag/v1.22.0), and it is patched in [v1.22.2](https://github.com/authzed/spicedb/releases/tag/v1.22.2) (there is no v1.22.1 release, though there is a git tag). ### References - https://github.com/authzed/spicedb/pull/1397 ### For more information If you have any questions or comments about this advisory: * Open an issue in [SpiceDB](https://github.com/authzed/spicedb) * Ask a question in the [SpiceDB Discord](https://authzed.com/discord)

SpiceDB es un sistema de base de datos de código abierto, inspirado en Google Zanzibar, para crear y gestionar permisos de aplicaciones críticos para la seguridad. Cualquier usuario que tome una decisión de autorización negativa basada en los resultados de una solicitud "LookupResources" con la versión 1.22.0 se ve afectado. Por ejemplo, si se utiliza "LookupResources" para buscar una lista de recursos a los que permitir el acceso, no pasa nada: algunos sujetos que deberían tener acceso a un recurso pueden no tenerlo. Pero si en cambio se utiliza "LookupResources" para encontrar una lista de recursos prohibidos, entonces algunos usuarios que no deberían tener acceso podrían tenerlo. En general, "LookupResources" no sirve ni deberia servir para bloquear el acceso de esta forma: para eso está la API "Check". Además, la versión 1.22.0 ha incluido una advertencia sobre este error desde su lanzamiento inicial. Se recomienda a los usuarios que actualicen a la versión 1.22.2. Los usuarios que no puedan actualizarse deberían evitar el uso de "LookupResources" para decisiones de autorización negativas.