CVE-2023-43645

Summary

CVE-2023-43645 is a denial-of-service vulnerability affecting OpenFGA, an authorization engine. The issue arises when the engine encounters circular relationship definitions in certain authorization models. When specific checks are made against these models, the server can exhaust resources and crash. The recommended solution is upgrading to OpenFGA v1.3.2 and updating any problematic models. Models with cyclic definitions or a relation in its evaluation path will no longer be evaluated on v1.3.2 and above, causing checks and queries to return errors instead. Users with models free of cycles are not impacted.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.