x/vulndb: potential Go vuln in github.com/open-policy-agent/opa: GHSA-c77r-fh37-x2px

[GoVulnBot]

Advisory GHSA-c77r-fh37-x2px references a vulnerability in the following Go modules:

Module
github.com/open-policy-agent/opa

Description:
A SMB force-authentication vulnerability exists in all versions of OPA for Windows prior to v0.68.0. The vulnerability exists because of improper input validation, allowing a user to pass an arbitrary SMB share instead of a Rego file as an argument to OPA CLI or to one of the OPA Go library’s functions.

References:

• ADVISORY: GHSA-c77r-fh37-x2px
• ADVISORY: https://nvd.nist.gov/vuln/detail/CVE-2024-8260
• FIX: open-policy-agent/opa@10f4d55
• WEB: https://github.com/open-policy-agent/opa/releases/tag/v0.68.0
• WEB: https://www.tenable.com/security/research/tra-2024-36

Cross references:

• github.com/open-policy-agent/opa appears in 4 other report(s):
  • data/reports/GO-2022-0316.yaml (x/vulndb: potential Go vuln in github.com/open-policy-agent/opa: CVE-2022-23628 #316)
  • data/reports/GO-2022-0574.yaml (x/vulndb: potential Go vuln in github.com/open-policy-agent/opa: GHSA-2m4x-4q9j-w97g #574)
  • data/reports/GO-2022-0587.yaml (x/vulndb: potential Go vuln in github.com/open-policy-agent/opa: GHSA-x7f3-62pm-9p38 #587)
  • data/reports/GO-2022-0978.yaml (x/vulndb: potential Go vuln in github.com/open-policy-agent/opa: CVE-2022-36085 #978)

See doc/quickstart.md for instructions on how to triage this report.

id: GO-ID-PENDING
modules:
    - module: github.com/open-policy-agent/opa
      versions:
        - fixed: 0.68.0
      vulnerable_at: 0.67.1
summary: OPA for Windows has an SMB force-authentication vulnerability in github.com/open-policy-agent/opa
cves:
    - CVE-2024-8260
ghsas:
    - GHSA-c77r-fh37-x2px
references:
    - advisory: https://github.com/advisories/GHSA-c77r-fh37-x2px
    - advisory: https://nvd.nist.gov/vuln/detail/CVE-2024-8260
    - fix: https://github.com/open-policy-agent/opa/commit/10f4d553e6bb6ae9c69611ecdd9a77dda857070e
    - web: https://github.com/open-policy-agent/opa/releases/tag/v0.68.0
    - web: https://www.tenable.com/security/research/tra-2024-36
source:
    id: GHSA-c77r-fh37-x2px
    created: 2024-09-19T20:01:18.939320734Z
review_status: UNREVIEWED

[gopherbot]

Change https://go.dev/cl/614615 mentions this issue: data/reports: add GO-2024-3141