Open Policy Agent (OPA) 0.42.0

CPE Details

Open Policy Agent (OPA) 0.42.0
openpolicyagent
open_policy_agent
0.42.0
2022-07-08
16h30 +00:00
2022-07-11
11h08 +00:00
CPE NVD
Alerte pour un CPE
Stay informed of any changes for a specific CPE.
Notifications manage

CPE Name: cpe:2.3:a:openpolicyagent:open_policy_agent:0.42.0:*:*:*:*:*:*:*

Informations

Vendor

openpolicyagent

Product

open_policy_agent

Version

0.42.0

Related CVE

Open and find in CVE List

CVE ID Published Description Score Severity
CVE-2024-8260 2024-08-30 12h22 +00:00 A SMB force-authentication vulnerability exists in all versions of OPA for Windows prior to v0.68.0. The vulnerability exists because of improper input validation, allowing a user to pass an arbitrary SMB share instead of a Rego file as an argument to OPA CLI or to one of the OPA Go library’s functions.
7.3
High
CVE-2022-36085 2022-09-08 11h30 +00:00 Open Policy Agent (OPA) is an open source, general-purpose policy engine. The Rego compiler provides a (deprecated) `WithUnsafeBuiltins` function, which allows users to provide a set of built-in functions that should be deemed unsafe — and as such rejected — by the compiler if encountered in the policy compilation stage. A bypass of this protection has been found, where the use of the `with` keyword to mock such a built-in function (a feature introduced in OPA v0.40.0), isn’t taken into account by `WithUnsafeBuiltins`. Multiple conditions need to be met in order to create an adverse effect. Version 0.43.1 contains a patch for this issue. As a workaround, avoid using the `WithUnsafeBuiltins` function and use the `capabilities` feature instead.
9.8
Critical