Open Policy Agent (OPA) 0.40.0

CPE Details

Open Policy Agent (OPA) 0.40.0
openpolicyagent
open_policy_agent
0.40.0
2022-07-08
16h30 +00:00
2022-07-11
11h08 +00:00
CPE NVD
Alerte pour un CPE
Restez informé de toutes modifications pour un CPE spécifique.
Gestion des notifications

CPE Name: cpe:2.3:a:openpolicyagent:open_policy_agent:0.40.0:*:*:*:*:*:*:*

Informations

Vendor

openpolicyagent

Product

open_policy_agent

Version

0.40.0

Related CVE

Open and find in CVE List

CVE ID Publié Description Score Gravité
CVE-2024-8260 2024-08-30 12h22 +00:00 A SMB force-authentication vulnerability exists in all versions of OPA for Windows prior to v0.68.0. The vulnerability exists because of improper input validation, allowing a user to pass an arbitrary SMB share instead of a Rego file as an argument to OPA CLI or to one of the OPA Go library’s functions.
7.3
Haute
CVE-2022-36085 2022-09-08 11h30 +00:00 Open Policy Agent (OPA) is an open source, general-purpose policy engine. The Rego compiler provides a (deprecated) `WithUnsafeBuiltins` function, which allows users to provide a set of built-in functions that should be deemed unsafe — and as such rejected — by the compiler if encountered in the policy compilation stage. A bypass of this protection has been found, where the use of the `with` keyword to mock such a built-in function (a feature introduced in OPA v0.40.0), isn’t taken into account by `WithUnsafeBuiltins`. Multiple conditions need to be met in order to create an adverse effect. Version 0.43.1 contains a patch for this issue. As a workaround, avoid using the `WithUnsafeBuiltins` function and use the `capabilities` feature instead.
9.8
Critique
CVE-2022-33082 2022-06-30 19h50 +00:00 An issue in the AST parser (ast/compile.go) of Open Policy Agent v0.10.2 allows attackers to cause a Denial of Service (DoS) via a crafted input.
7.5
Haute