Vulnerability Report: GO-2022-0587
- CVE-2022-28946, GHSA-x7f3-62pm-9p38
- Affects: github.com/open-policy-agent/opa
- Published: May 20, 2022
- Modified: Jun 12, 2023
An issue in ast.Parser in Open Policy Agent causes the application to incorrectly interpret expressions, allowing a Denial of Service (DoS) via triggering out-of-range memory access.
Affected Packages
-
PathVersionsSymbols
-
before v0.40.0
30 affected symbols
- CompileModules
- CompileModulesWithOpt
- MustCompileModules
- MustCompileModulesWithOpts
- MustParseBody
- MustParseBodyWithOpts
- MustParseExpr
- MustParseImports
- MustParseModule
- MustParseModuleWithOpts
- MustParsePackage
- MustParseRef
- MustParseRule
- MustParseStatement
- MustParseStatements
- MustParseTerm
- ParseBody
- ParseBodyWithOpts
- ParseExpr
- ParseImports
- ParseModule
- ParseModuleWithOpts
- ParsePackage
- ParseRef
- ParseRule
- ParseStatement
- ParseStatements
- ParseStatementsWithOpts
- ParseTerm
- Parser.Parse
Aliases
References
- https://github.com/open-policy-agent/opa/pull/4548
- https://github.com/open-policy-agent/opa/commit/e9d3828db670cbe11129885f37f08cbf04935264
- https://vuln.go.dev/ID/GO-2022-0587.json
Credits
- Norbert Szetei of Doyensec
Feedback
See anything missing or incorrect?
Suggest an edit to this report.