Description
A SMB force-authentication vulnerability exists in all versions of OPA for Windows prior to v0.68.0. The vulnerability exists because of improper input validation, allowing a user to pass an arbitrary SMB share instead of a Rego file as an argument to OPA CLI or to one of the OPA Go library’s functions.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Styra | OPA | < v0.68.0 | v0.68.0 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | conftest | 0.55.0-r2 | — |
| Wolfi rolling | cosign | 2.4.0-r4 | — |
| Wolfi rolling | k8sgpt | 0.3.42-r1 | — |
| Wolfi rolling | kots +2 | 1.117.2-r1 | — |
| Wolfi rolling | kubescape | 3.0.18-r0 | — |
| Wolfi rolling | opa | 0.68.0-r0 | — |
| Wolfi rolling | policy-controller +1 | 0.9.0-r10 | — |
| Wolfi rolling | snyk-cli | 1.1293.1-r1 | — |
| Wolfi rolling | spire-agent +2 | 1.11.2-r5 | — |
| Wolfi rolling | tfsec | 1.28.10-r2 | — |
| Wolfi rolling | zarf | 0.40.1-r1 | — |
| Wolfi rolling | zot | 2.1.1-r2 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Go | github.com/open-policy-agent/opa | < 0.68.0 | 0.68.0 | GHSA-c77r-fh37-x2px |