~ / search / GHSA-c77r-fh37-x2px

GHSA-c77r-fh37-x2px

OPA for Windows has an SMB force-authentication vulnerability

Source: GitHub Advisory Database (reviewed) Moderate CVE-2024-8260

Packages

EcosystemPackageAffectedFixed in
Go github.com/open-policy-agent/opa < 0.68.0 0.68.0

Details

As written in the advisory (Markdown source, shown as plain text).

A SMB force-authentication vulnerability exists in all versions of OPA for Windows prior to v0.68.0. The vulnerability exists because of improper input validation, allowing a user to pass an arbitrary SMB share instead of a Rego file as an argument to OPA CLI or to one of the OPA Go library’s functions.

References

External links from the advisory. They lead to third-party sites.