cvelistv5 - cve-2022-36085

CVE-2022-36085 (GCVE-0-2022-36085)

Vulnerability from cvelistv5 – Published: 2022-09-08 13:30 – Updated: 2025-04-22 17:23

Summary

Open Policy Agent (OPA) is an open source, general-purpose policy engine. The Rego compiler provides a (deprecated) `WithUnsafeBuiltins` function, which allows users to provide a set of built-in functions that should be deemed unsafe — and as such rejected — by the compiler if encountered in the policy compilation stage. A bypass of this protection has been found, where the use of the `with` keyword to mock such a built-in function (a feature introduced in OPA v0.40.0), isn’t taken into account by `WithUnsafeBuiltins`. Multiple conditions need to be met in order to create an adverse effect. Version 0.43.1 contains a patch for this issue. As a workaround, avoid using the `WithUnsafeBuiltins` function and use the `capabilities` feature instead.

Severity ?

7.4 (High)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

CWE

CWE-693 - Protection Mechanism Failure
CWE-20 - Improper Input Validation

Assigner

GitHub_M

References

URL

Tags

	https://github.com/open-policy-agent/opa/security…	x_refsource_CONFIRM
	https://github.com/open-policy-agent/opa/pull/4540	x_refsource_MISC
	https://github.com/open-policy-agent/opa/pull/4616	x_refsource_MISC
	https://github.com/open-policy-agent/opa/commit/2…	x_refsource_MISC
	https://github.com/open-policy-agent/opa/commit/3…	x_refsource_MISC
	https://github.com/open-policy-agent/opa/releases…	x_refsource_MISC

Impacted products

	Vendor	Product	Version
	open-policy-agent	opa	Affected: >= 0.40.0, < 0.43.1

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T09:52:00.645Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/open-policy-agent/opa/security/advisories/GHSA-f524-rf33-2jjr"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/open-policy-agent/opa/pull/4540"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/open-policy-agent/opa/pull/4616"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/open-policy-agent/opa/commit/25a597bc3f4985162e7f65f9c36599f4f8f55823"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/open-policy-agent/opa/commit/3e8c754ed007b22393cf65e48751ad9f6457fee8"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/open-policy-agent/opa/releases/tag/v0.43.1"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2022-36085",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-04-22T15:42:09.440338Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-04-22T17:23:14.762Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "opa",
          "vendor": "open-policy-agent",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 0.40.0, \u003c 0.43.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Open Policy Agent (OPA) is an open source, general-purpose policy engine. The Rego compiler provides a (deprecated) `WithUnsafeBuiltins` function, which allows users to provide a set of built-in functions that should be deemed unsafe \u2014 and as such rejected \u2014 by the compiler if encountered in the policy compilation stage. A bypass of this protection has been found, where the use of the `with` keyword to mock such a built-in function (a feature introduced in OPA v0.40.0), isn\u2019t taken into account by `WithUnsafeBuiltins`. Multiple conditions need to be met in order to create an adverse effect. Version 0.43.1 contains a patch for this issue. As a workaround, avoid using the `WithUnsafeBuiltins` function and use the `capabilities` feature instead."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.4,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-693",
              "description": "CWE-693: Protection Mechanism Failure",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-20",
              "description": "CWE-20: Improper Input Validation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-09-08T13:30:16.000Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/open-policy-agent/opa/security/advisories/GHSA-f524-rf33-2jjr"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/open-policy-agent/opa/pull/4540"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/open-policy-agent/opa/pull/4616"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/open-policy-agent/opa/commit/25a597bc3f4985162e7f65f9c36599f4f8f55823"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/open-policy-agent/opa/commit/3e8c754ed007b22393cf65e48751ad9f6457fee8"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/open-policy-agent/opa/releases/tag/v0.43.1"
        }
      ],
      "source": {
        "advisory": "GHSA-f524-rf33-2jjr",
        "discovery": "UNKNOWN"
      },
      "title": "OPA Compiler: Bypass of WithUnsafeBuiltins using `with` keyword to mock functions",
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security-advisories@github.com",
          "ID": "CVE-2022-36085",
          "STATE": "PUBLIC",
          "TITLE": "OPA Compiler: Bypass of WithUnsafeBuiltins using `with` keyword to mock functions"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "opa",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "\u003e= 0.40.0, \u003c 0.43.1"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "open-policy-agent"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Open Policy Agent (OPA) is an open source, general-purpose policy engine. The Rego compiler provides a (deprecated) `WithUnsafeBuiltins` function, which allows users to provide a set of built-in functions that should be deemed unsafe \u2014 and as such rejected \u2014 by the compiler if encountered in the policy compilation stage. A bypass of this protection has been found, where the use of the `with` keyword to mock such a built-in function (a feature introduced in OPA v0.40.0), isn\u2019t taken into account by `WithUnsafeBuiltins`. Multiple conditions need to be met in order to create an adverse effect. Version 0.43.1 contains a patch for this issue. As a workaround, avoid using the `WithUnsafeBuiltins` function and use the `capabilities` feature instead."
            }
          ]
        },
        "impact": {
          "cvss": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.4,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-693: Protection Mechanism Failure"
                }
              ]
            },
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-20: Improper Input Validation"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://github.com/open-policy-agent/opa/security/advisories/GHSA-f524-rf33-2jjr",
              "refsource": "CONFIRM",
              "url": "https://github.com/open-policy-agent/opa/security/advisories/GHSA-f524-rf33-2jjr"
            },
            {
              "name": "https://github.com/open-policy-agent/opa/pull/4540",
              "refsource": "MISC",
              "url": "https://github.com/open-policy-agent/opa/pull/4540"
            },
            {
              "name": "https://github.com/open-policy-agent/opa/pull/4616",
              "refsource": "MISC",
              "url": "https://github.com/open-policy-agent/opa/pull/4616"
            },
            {
              "name": "https://github.com/open-policy-agent/opa/commit/25a597bc3f4985162e7f65f9c36599f4f8f55823",
              "refsource": "MISC",
              "url": "https://github.com/open-policy-agent/opa/commit/25a597bc3f4985162e7f65f9c36599f4f8f55823"
            },
            {
              "name": "https://github.com/open-policy-agent/opa/commit/3e8c754ed007b22393cf65e48751ad9f6457fee8",
              "refsource": "MISC",
              "url": "https://github.com/open-policy-agent/opa/commit/3e8c754ed007b22393cf65e48751ad9f6457fee8"
            },
            {
              "name": "https://github.com/open-policy-agent/opa/releases/tag/v0.43.1",
              "refsource": "MISC",
              "url": "https://github.com/open-policy-agent/opa/releases/tag/v0.43.1"
            }
          ]
        },
        "source": {
          "advisory": "GHSA-f524-rf33-2jjr",
          "discovery": "UNKNOWN"
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2022-36085",
    "datePublished": "2022-09-08T13:30:16.000Z",
    "dateReserved": "2022-07-15T00:00:00.000Z",
    "dateUpdated": "2025-04-22T17:23:14.762Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "fkie_nvd": {
      "configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:openpolicyagent:open_policy_agent:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"0.40.0\", \"versionEndExcluding\": \"0.43.1\", \"matchCriteriaId\": \"24044142-C7B3-4994-9F36-5ED0299C8E5B\"}]}]}]",
      "descriptions": "[{\"lang\": \"en\", \"value\": \"Open Policy Agent (OPA) is an open source, general-purpose policy engine. The Rego compiler provides a (deprecated) `WithUnsafeBuiltins` function, which allows users to provide a set of built-in functions that should be deemed unsafe \\u2014 and as such rejected \\u2014 by the compiler if encountered in the policy compilation stage. A bypass of this protection has been found, where the use of the `with` keyword to mock such a built-in function (a feature introduced in OPA v0.40.0), isn\\u2019t taken into account by `WithUnsafeBuiltins`. Multiple conditions need to be met in order to create an adverse effect. Version 0.43.1 contains a patch for this issue. As a workaround, avoid using the `WithUnsafeBuiltins` function and use the `capabilities` feature instead.\"}, {\"lang\": \"es\", \"value\": \"Open Policy Agent (OPA) es un motor de pol\\u00edticas de prop\\u00f3sito general de c\\u00f3digo abierto.\u0026#xa0;El compilador de Rego proporciona una funci\\u00f3n \\\"WithUnsafeBuiltins\\\" (en desuso), que permite a usuarios proporcionar un conjunto de funciones integradas que el compilador deber\\u00eda considerar inseguras y, como tales, rechazarlas si son encontradas en la etapa de compilaci\\u00f3n de pol\\u00edticas. .\u0026#xa0;Se ha encontrado una omisi\\u00f3n de esta protecci\\u00f3n, en la que \\\"WithUnsafeBuiltins\\\" no es tenido en cuenta el uso de la palabra clave \\\"with\\\" para simular una funci\\u00f3n integrada de este tipo (una caracter\\u00edstica introducida en OPA v0.40.0).\u0026#xa0;Deben cumplirse m\\u00faltiples condiciones para crear un efecto adverso.\u0026#xa0;La versi\\u00f3n 0.43.1 contiene un parche para este problema.\u0026#xa0;Como mitigaci\\u00f3n, evite usar la funci\\u00f3n \\\"WithUnsafeBuiltins\\\" y use la funcionalidad \\\"capabilities\\\" en su lugar\"}]",
      "id": "CVE-2022-36085",
      "lastModified": "2024-11-21T07:12:21.110",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"security-advisories@github.com\", \"type\": \"Secondary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N\", \"baseScore\": 7.4, \"baseSeverity\": \"HIGH\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"HIGH\", \"privilegesRequired\": \"NONE\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"HIGH\", \"availabilityImpact\": \"NONE\"}, \"exploitabilityScore\": 2.2, \"impactScore\": 5.2}, {\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\", \"baseScore\": 9.8, \"baseSeverity\": \"CRITICAL\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"NONE\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"HIGH\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 3.9, \"impactScore\": 5.9}]}",
      "published": "2022-09-08T14:15:08.340",
      "references": "[{\"url\": \"https://github.com/open-policy-agent/opa/commit/25a597bc3f4985162e7f65f9c36599f4f8f55823\", \"source\": \"security-advisories@github.com\", \"tags\": [\"Patch\", \"Third Party Advisory\"]}, {\"url\": \"https://github.com/open-policy-agent/opa/commit/3e8c754ed007b22393cf65e48751ad9f6457fee8\", \"source\": \"security-advisories@github.com\", \"tags\": [\"Patch\", \"Third Party Advisory\"]}, {\"url\": \"https://github.com/open-policy-agent/opa/pull/4540\", \"source\": \"security-advisories@github.com\", \"tags\": [\"Exploit\", \"Patch\", \"Third Party Advisory\"]}, {\"url\": \"https://github.com/open-policy-agent/opa/pull/4616\", \"source\": \"security-advisories@github.com\", \"tags\": [\"Exploit\", \"Patch\", \"Third Party Advisory\"]}, {\"url\": \"https://github.com/open-policy-agent/opa/releases/tag/v0.43.1\", \"source\": \"security-advisories@github.com\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"https://github.com/open-policy-agent/opa/security/advisories/GHSA-f524-rf33-2jjr\", \"source\": \"security-advisories@github.com\", \"tags\": [\"Exploit\", \"Patch\", \"Third Party Advisory\"]}, {\"url\": \"https://github.com/open-policy-agent/opa/commit/25a597bc3f4985162e7f65f9c36599f4f8f55823\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\", \"Third Party Advisory\"]}, {\"url\": \"https://github.com/open-policy-agent/opa/commit/3e8c754ed007b22393cf65e48751ad9f6457fee8\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\", \"Third Party Advisory\"]}, {\"url\": \"https://github.com/open-policy-agent/opa/pull/4540\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Exploit\", \"Patch\", \"Third Party Advisory\"]}, {\"url\": \"https://github.com/open-policy-agent/opa/pull/4616\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Exploit\", \"Patch\", \"Third Party Advisory\"]}, {\"url\": \"https://github.com/open-policy-agent/opa/releases/tag/v0.43.1\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"https://github.com/open-policy-agent/opa/security/advisories/GHSA-f524-rf33-2jjr\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Exploit\", \"Patch\", \"Third Party Advisory\"]}]",
      "sourceIdentifier": "security-advisories@github.com",
      "vulnStatus": "Modified",
      "weaknesses": "[{\"source\": \"security-advisories@github.com\", \"type\": \"Secondary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-20\"}, {\"lang\": \"en\", \"value\": \"CWE-693\"}]}, {\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"NVD-CWE-noinfo\"}]}]"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2022-36085\",\"sourceIdentifier\":\"security-advisories@github.com\",\"published\":\"2022-09-08T14:15:08.340\",\"lastModified\":\"2024-11-21T07:12:21.110\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Open Policy Agent (OPA) is an open source, general-purpose policy engine. The Rego compiler provides a (deprecated) `WithUnsafeBuiltins` function, which allows users to provide a set of built-in functions that should be deemed unsafe \u2014 and as such rejected \u2014 by the compiler if encountered in the policy compilation stage. A bypass of this protection has been found, where the use of the `with` keyword to mock such a built-in function (a feature introduced in OPA v0.40.0), isn\u2019t taken into account by `WithUnsafeBuiltins`. Multiple conditions need to be met in order to create an adverse effect. Version 0.43.1 contains a patch for this issue. As a workaround, avoid using the `WithUnsafeBuiltins` function and use the `capabilities` feature instead.\"},{\"lang\":\"es\",\"value\":\"Open Policy Agent (OPA) es un motor de pol\u00edticas de prop\u00f3sito general de c\u00f3digo abierto.\u0026#xa0;El compilador de Rego proporciona una funci\u00f3n \\\"WithUnsafeBuiltins\\\" (en desuso), que permite a usuarios proporcionar un conjunto de funciones integradas que el compilador deber\u00eda considerar inseguras y, como tales, rechazarlas si son encontradas en la etapa de compilaci\u00f3n de pol\u00edticas. .\u0026#xa0;Se ha encontrado una omisi\u00f3n de esta protecci\u00f3n, en la que \\\"WithUnsafeBuiltins\\\" no es tenido en cuenta el uso de la palabra clave \\\"with\\\" para simular una funci\u00f3n integrada de este tipo (una caracter\u00edstica introducida en OPA v0.40.0).\u0026#xa0;Deben cumplirse m\u00faltiples condiciones para crear un efecto adverso.\u0026#xa0;La versi\u00f3n 0.43.1 contiene un parche para este problema.\u0026#xa0;Como mitigaci\u00f3n, evite usar la funci\u00f3n \\\"WithUnsafeBuiltins\\\" y use la funcionalidad \\\"capabilities\\\" en su lugar\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N\",\"baseScore\":7.4,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"HIGH\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":2.2,\"impactScore\":5.2},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":9.8,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":5.9}]},\"weaknesses\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-20\"},{\"lang\":\"en\",\"value\":\"CWE-693\"}]},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"NVD-CWE-noinfo\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:openpolicyagent:open_policy_agent:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"0.40.0\",\"versionEndExcluding\":\"0.43.1\",\"matchCriteriaId\":\"24044142-C7B3-4994-9F36-5ED0299C8E5B\"}]}]}],\"references\":[{\"url\":\"https://github.com/open-policy-agent/opa/commit/25a597bc3f4985162e7f65f9c36599f4f8f55823\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Patch\",\"Third Party Advisory\"]},{\"url\":\"https://github.com/open-policy-agent/opa/commit/3e8c754ed007b22393cf65e48751ad9f6457fee8\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Patch\",\"Third Party Advisory\"]},{\"url\":\"https://github.com/open-policy-agent/opa/pull/4540\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Exploit\",\"Patch\",\"Third Party Advisory\"]},{\"url\":\"https://github.com/open-policy-agent/opa/pull/4616\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Exploit\",\"Patch\",\"Third Party Advisory\"]},{\"url\":\"https://github.com/open-policy-agent/opa/releases/tag/v0.43.1\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://github.com/open-policy-agent/opa/security/advisories/GHSA-f524-rf33-2jjr\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Exploit\",\"Patch\",\"Third Party Advisory\"]},{\"url\":\"https://github.com/open-policy-agent/opa/commit/25a597bc3f4985162e7f65f9c36599f4f8f55823\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\",\"Third Party Advisory\"]},{\"url\":\"https://github.com/open-policy-agent/opa/commit/3e8c754ed007b22393cf65e48751ad9f6457fee8\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\",\"Third Party Advisory\"]},{\"url\":\"https://github.com/open-policy-agent/opa/pull/4540\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Exploit\",\"Patch\",\"Third Party Advisory\"]},{\"url\":\"https://github.com/open-policy-agent/opa/pull/4616\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Exploit\",\"Patch\",\"Third Party Advisory\"]},{\"url\":\"https://github.com/open-policy-agent/opa/releases/tag/v0.43.1\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://github.com/open-policy-agent/opa/security/advisories/GHSA-f524-rf33-2jjr\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Exploit\",\"Patch\",\"Third Party Advisory\"]}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://github.com/open-policy-agent/opa/security/advisories/GHSA-f524-rf33-2jjr\", \"tags\": [\"x_refsource_CONFIRM\", \"x_transferred\"]}, {\"url\": \"https://github.com/open-policy-agent/opa/pull/4540\", \"tags\": [\"x_refsource_MISC\", \"x_transferred\"]}, {\"url\": \"https://github.com/open-policy-agent/opa/pull/4616\", \"tags\": [\"x_refsource_MISC\", \"x_transferred\"]}, {\"url\": \"https://github.com/open-policy-agent/opa/commit/25a597bc3f4985162e7f65f9c36599f4f8f55823\", \"tags\": [\"x_refsource_MISC\", \"x_transferred\"]}, {\"url\": \"https://github.com/open-policy-agent/opa/commit/3e8c754ed007b22393cf65e48751ad9f6457fee8\", \"tags\": [\"x_refsource_MISC\", \"x_transferred\"]}, {\"url\": \"https://github.com/open-policy-agent/opa/releases/tag/v0.43.1\", \"tags\": [\"x_refsource_MISC\", \"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-03T09:52:00.645Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2022-36085\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"poc\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2025-04-22T15:42:09.440338Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2025-04-22T15:42:11.094Z\"}}], \"cna\": {\"title\": \"OPA Compiler: Bypass of WithUnsafeBuiltins using `with` keyword to mock functions\", \"source\": {\"advisory\": \"GHSA-f524-rf33-2jjr\", \"discovery\": \"UNKNOWN\"}, \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 7.4, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"HIGH\", \"availabilityImpact\": \"NONE\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"HIGH\"}}], \"affected\": [{\"vendor\": \"open-policy-agent\", \"product\": \"opa\", \"versions\": [{\"status\": \"affected\", \"version\": \"\u003e= 0.40.0, \u003c 0.43.1\"}]}], \"references\": [{\"url\": \"https://github.com/open-policy-agent/opa/security/advisories/GHSA-f524-rf33-2jjr\", \"tags\": [\"x_refsource_CONFIRM\"]}, {\"url\": \"https://github.com/open-policy-agent/opa/pull/4540\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/open-policy-agent/opa/pull/4616\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/open-policy-agent/opa/commit/25a597bc3f4985162e7f65f9c36599f4f8f55823\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/open-policy-agent/opa/commit/3e8c754ed007b22393cf65e48751ad9f6457fee8\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/open-policy-agent/opa/releases/tag/v0.43.1\", \"tags\": [\"x_refsource_MISC\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"Open Policy Agent (OPA) is an open source, general-purpose policy engine. The Rego compiler provides a (deprecated) `WithUnsafeBuiltins` function, which allows users to provide a set of built-in functions that should be deemed unsafe \\u2014 and as such rejected \\u2014 by the compiler if encountered in the policy compilation stage. A bypass of this protection has been found, where the use of the `with` keyword to mock such a built-in function (a feature introduced in OPA v0.40.0), isn\\u2019t taken into account by `WithUnsafeBuiltins`. Multiple conditions need to be met in order to create an adverse effect. Version 0.43.1 contains a patch for this issue. As a workaround, avoid using the `WithUnsafeBuiltins` function and use the `capabilities` feature instead.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-693\", \"description\": \"CWE-693: Protection Mechanism Failure\"}]}, {\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-20\", \"description\": \"CWE-20: Improper Input Validation\"}]}], \"providerMetadata\": {\"orgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"shortName\": \"GitHub_M\", \"dateUpdated\": \"2022-09-08T13:30:16.000Z\"}, \"x_legacyV4Record\": {\"impact\": {\"cvss\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 7.4, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"HIGH\", \"availabilityImpact\": \"NONE\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"HIGH\"}}, \"source\": {\"advisory\": \"GHSA-f524-rf33-2jjr\", \"discovery\": \"UNKNOWN\"}, \"affects\": {\"vendor\": {\"vendor_data\": [{\"product\": {\"product_data\": [{\"version\": {\"version_data\": [{\"version_value\": \"\u003e= 0.40.0, \u003c 0.43.1\"}]}, \"product_name\": \"opa\"}]}, \"vendor_name\": \"open-policy-agent\"}]}}, \"data_type\": \"CVE\", \"references\": {\"reference_data\": [{\"url\": \"https://github.com/open-policy-agent/opa/security/advisories/GHSA-f524-rf33-2jjr\", \"name\": \"https://github.com/open-policy-agent/opa/security/advisories/GHSA-f524-rf33-2jjr\", \"refsource\": \"CONFIRM\"}, {\"url\": \"https://github.com/open-policy-agent/opa/pull/4540\", \"name\": \"https://github.com/open-policy-agent/opa/pull/4540\", \"refsource\": \"MISC\"}, {\"url\": \"https://github.com/open-policy-agent/opa/pull/4616\", \"name\": \"https://github.com/open-policy-agent/opa/pull/4616\", \"refsource\": \"MISC\"}, {\"url\": \"https://github.com/open-policy-agent/opa/commit/25a597bc3f4985162e7f65f9c36599f4f8f55823\", \"name\": \"https://github.com/open-policy-agent/opa/commit/25a597bc3f4985162e7f65f9c36599f4f8f55823\", \"refsource\": \"MISC\"}, {\"url\": \"https://github.com/open-policy-agent/opa/commit/3e8c754ed007b22393cf65e48751ad9f6457fee8\", \"name\": \"https://github.com/open-policy-agent/opa/commit/3e8c754ed007b22393cf65e48751ad9f6457fee8\", \"refsource\": \"MISC\"}, {\"url\": \"https://github.com/open-policy-agent/opa/releases/tag/v0.43.1\", \"name\": \"https://github.com/open-policy-agent/opa/releases/tag/v0.43.1\", \"refsource\": \"MISC\"}]}, \"data_format\": \"MITRE\", \"description\": {\"description_data\": [{\"lang\": \"eng\", \"value\": \"Open Policy Agent (OPA) is an open source, general-purpose policy engine. The Rego compiler provides a (deprecated) `WithUnsafeBuiltins` function, which allows users to provide a set of built-in functions that should be deemed unsafe \\u2014 and as such rejected \\u2014 by the compiler if encountered in the policy compilation stage. A bypass of this protection has been found, where the use of the `with` keyword to mock such a built-in function (a feature introduced in OPA v0.40.0), isn\\u2019t taken into account by `WithUnsafeBuiltins`. Multiple conditions need to be met in order to create an adverse effect. Version 0.43.1 contains a patch for this issue. As a workaround, avoid using the `WithUnsafeBuiltins` function and use the `capabilities` feature instead.\"}]}, \"problemtype\": {\"problemtype_data\": [{\"description\": [{\"lang\": \"eng\", \"value\": \"CWE-693: Protection Mechanism Failure\"}]}, {\"description\": [{\"lang\": \"eng\", \"value\": \"CWE-20: Improper Input Validation\"}]}]}, \"data_version\": \"4.0\", \"CVE_data_meta\": {\"ID\": \"CVE-2022-36085\", \"STATE\": \"PUBLIC\", \"TITLE\": \"OPA Compiler: Bypass of WithUnsafeBuiltins using `with` keyword to mock functions\", \"ASSIGNER\": \"security-advisories@github.com\"}}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2022-36085\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2025-04-22T17:23:14.762Z\", \"dateReserved\": \"2022-07-15T00:00:00.000Z\", \"assignerOrgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"datePublished\": \"2022-09-08T13:30:16.000Z\", \"assignerShortName\": \"GitHub_M\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}

GHSA-F524-RF33-2JJR

Vulnerability from github – Published: 2022-09-16 17:42 – Updated: 2024-01-23 20:38

Summary

OPA Compiler: Bypass of WithUnsafeBuiltins using "with" keyword to mock functions

Details

Impact

The Rego compiler provides a (deprecated) WithUnsafeBuiltins function, which allows users to provide a set of built-in functions that should be deemed unsafe — and as such rejected — by the compiler if encountered in the policy compilation stage. A bypass of this protection has been found, where the use of the with keyword to mock such a built-in function (a feature introduced in OPA v0.40.0), isn’t taken into account by WithUnsafeBuiltins.

The same method is exposed via rego.UnsafeBuiltins in the github.com/open-policy-agent/opa/rego package.

When provided e.g. the http.send built-in function to WithUnsafeBuiltins, the following policy would still compile, and call the http.send function with the arguments provided to the is_object function when evaluated:

package policy

foo := is_object({
    "method": "get", 
    "url": "https://www.openpolicyagent.org"
})

allow := r {
    r := foo with is_object as http.send
}

Both built-in functions and user provided (i.e. custom) functions are mockable using this construct.

In addition to http.send, the opa.runtime built-in function is commonly considered unsafe in integrations where policy provided by untrusted parties is evaluated, as it risks exposing configuration, or environment variables, potentially carrying sensitive information.

Affected Users

All of these conditions have to be met to create an adverse effect:

Use the Go API for policy evaluation (not the OPA server, or the Go SDK)
Make use of the WithUnsafeBuiltins method in order to deny certain built-in functions, like e.g. http.send, from being used in policy evaluation.
Allow policy evaluation of policies provided by untrusted parties.
The policies evaluated include the with keyword to rewrite/mock a built-in, or custom, function to that of another built-in function, such as http.send.

Additionally, the OPA Query API is affected: * If the OPA Query API is exposed to the public, and it is relied on http.send to be unavailable in that context. Exposing the OPA API to the public without proper authentication and authorization in place is generally advised against.

Patches

v0.43.1, v0.44.0

Workarounds

The WithUnsafeBuiltins function has been considered deprecated since the introduction of the capabilities feature in OPA v0.23.0 . While the function was commented as deprecated, the format of the comment was however not following the convention for deprecated functions, and might not have been picked up by tooling like editors. This has now been fixed. Users are still encouraged to use the capabilities feature over the deprecated WithUnsafeBuiltins function.

If you cannot upgrade, consider using capabilities instead:

Code like this using the github.com/open-policy-agent/opa/ast package:

// VULNERABLE with OPA <= 0.43.0
unsafeBuiltins := map[string]struct{}{
    ast.HTTPSend.Name: struct{}{},
}
compiler := ast.NewCompiler().WithUnsafeBuiltins(unsafeBuiltins)

needs to be changed to this:

caps := ast.CapabilitiesForThisVersion()
var j int
for i, bi := range caps.Builtins {
    if bi.Name == ast.HTTPSend.Name {
        j = i
        break
    }
}
caps.Builtins[j] = caps.Builtins[len(caps.Builtins)-1] // put last element into position j
caps.Builtins = caps.Builtins[:len(caps.Builtins)-1]   // truncate slice

compiler := ast.NewCompiler().WithCapabilities(caps)

When using the github.com/open-policy-agent/opa/rego package:

// VULNERABLE with OPA <= 0.43.0
r := rego.New(
    // other options omitted
    rego.UnsafeBuiltins(map[string]struct{}{ast.HTTPSend.Name: struct{}{}}),
)

needs to be changed to

r := rego.New(
    // other options omitted
    rego.Capabilities(caps),
)

with caps defined above.

Note that in the process, some error messages will change: http.send in this example will no longer be "unsafe" and thus forbidden, but it will simply become an "unknown function".

References

Fix commit on main: https://github.com/open-policy-agent/opa/commit/25a597bc3f4985162e7f65f9c36599f4f8f55823
Fix commit in 0.43.1 release: https://github.com/open-policy-agent/opa/commit/3e8c754ed007b22393cf65e48751ad9f6457fee8, release page for 0.43.1: https://github.com/open-policy-agent/opa/releases/tag/v0.43.1
Function mocking feature introduced in https://github.com/open-policy-agent/opa/pull/4540 and https://github.com/open-policy-agent/opa/pull/4616
Documentation on the capabilities feature, which is the preferred way of providing a list of allowed built-in functions. The capabilities feature is not affected by this vulnerability.

For more information

If you have any questions or comments about this advisory:

Open an issue in Community Discussions
Ask in Slack: https://slack.openpolicyagent.org/

Severity ?

7.4 (High)


                  
                    CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/open-policy-agent/opa"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0.40.0"
            },
            {
              "fixed": "0.43.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2022-36085"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-20"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2022-09-16T17:42:47Z",
    "nvd_published_at": "2022-09-08T14:15:00Z",
    "severity": "HIGH"
  },
  "details": "### Impact\n\nThe Rego compiler provides a (deprecated) `WithUnsafeBuiltins` function, which allows users to provide a set of built-in functions that should be deemed unsafe \u2014 and as such rejected \u2014 by the compiler if encountered in the policy compilation stage. A bypass of this protection has been found, where the use of the `with` keyword to mock such a built-in function (a feature introduced in OPA v0.40.0), isn\u2019t taken into account by `WithUnsafeBuiltins`.\n\nThe same method is exposed via `rego.UnsafeBuiltins` in the `github.com/open-policy-agent/opa/rego` package.\n\nWhen provided e.g. the `http.send` built-in function to `WithUnsafeBuiltins`, the following policy would still compile, and call the `http.send` function with the arguments provided to the `is_object` function when evaluated:\n\n```rego\npackage policy\n\nfoo := is_object({\n    \"method\": \"get\", \n    \"url\": \"https://www.openpolicyagent.org\"\n})\n\nallow := r {\n    r := foo with is_object as http.send\n}\n```\n\nBoth built-in functions and user provided (i.e. custom) functions are mockable using this construct.\n\nIn addition to `http.send`, the `opa.runtime` built-in function is commonly considered unsafe in integrations where policy provided by untrusted parties is evaluated, as it risks exposing configuration, or environment variables, potentially carrying sensitive information.\n\n#### Affected Users\n\n**All of these conditions have to be met** to create an adverse effect:\n\n* Use the Go API for policy evaluation (not the OPA server, or the Go SDK)\n* Make use of the `WithUnsafeBuiltins` method in order to deny certain built-in functions, like e.g. `http.send`, from being used in policy evaluation.\n* Allow policy evaluation of policies provided by untrusted parties.\n* The policies evaluated include the `with` keyword to rewrite/mock a built-in, or custom, function to that of another built-in function, such as `http.send`.\n\n**Additionally, the OPA Query API** is affected:\n* If the OPA [Query API](https://www.openpolicyagent.org/docs/latest/rest-api/#query-api) is exposed to the public, and it is relied on `http.send` to be unavailable in that context. Exposing the OPA API to the public without proper [authentication and authorization](https://www.openpolicyagent.org/docs/latest/security/#authentication-and-authorization) in place is generally advised against.\n\n### Patches\nv0.43.1, v0.44.0\n\n### Workarounds\n\nThe `WithUnsafeBuiltins`  function has been considered deprecated since the introduction of the [capabilities](https://www.openpolicyagent.org/docs/latest/deployments/#capabilities) feature in OPA v0.23.0 . While the function was commented as deprecated, the format of the comment was however not following the [convention](https://zchee.github.io/golang-wiki/Deprecated/) for deprecated functions, and might not have been picked up by tooling like editors. This has now been fixed. Users are still encouraged to use the capabilities feature over the deprecated `WithUnsafeBuiltins` function.\n\n**If you cannot upgrade**, consider using capabilities instead:\n\nCode like this using the `github.com/open-policy-agent/opa/ast` package:\n```go\n// VULNERABLE with OPA \u003c= 0.43.0\nunsafeBuiltins := map[string]struct{}{\n\tast.HTTPSend.Name: struct{}{},\n}\ncompiler := ast.NewCompiler().WithUnsafeBuiltins(unsafeBuiltins)\n```\n\nneeds to be changed to this:\n```go\ncaps := ast.CapabilitiesForThisVersion()\nvar j int\nfor i, bi := range caps.Builtins {\n\tif bi.Name == ast.HTTPSend.Name {\n\t\tj = i\n\t\tbreak\n\t}\n}\ncaps.Builtins[j] = caps.Builtins[len(caps.Builtins)-1] // put last element into position j\ncaps.Builtins = caps.Builtins[:len(caps.Builtins)-1]   // truncate slice\n\ncompiler := ast.NewCompiler().WithCapabilities(caps)\n```\n\nWhen using the `github.com/open-policy-agent/opa/rego` package:\n\n```go\n// VULNERABLE with OPA \u003c= 0.43.0\nr := rego.New(\n\t// other options omitted\n\trego.UnsafeBuiltins(map[string]struct{}{ast.HTTPSend.Name: struct{}{}}),\n)\n```\n\nneeds to be changed to\n```go\nr := rego.New(\n\t// other options omitted\n\trego.Capabilities(caps),\n)\n```\nwith `caps` defined above.\n\nNote that in the process, some error messages will change: `http.send` in this example will no longer be \"unsafe\" and thus forbidden, but it will simply become an \"unknown function\".\n\n### References\n\n* Fix commit on `main`: https://github.com/open-policy-agent/opa/commit/25a597bc3f4985162e7f65f9c36599f4f8f55823\n* Fix commit in 0.43.1 release: https://github.com/open-policy-agent/opa/commit/3e8c754ed007b22393cf65e48751ad9f6457fee8, release page for 0.43.1: https://github.com/open-policy-agent/opa/releases/tag/v0.43.1\n* Function mocking feature introduced in https://github.com/open-policy-agent/opa/pull/4540 and https://github.com/open-policy-agent/opa/pull/4616 \n* Documentation on the [capabilities](https://www.openpolicyagent.org/docs/latest/deployments/#capabilities) feature, which is the preferred way of providing a list of allowed built-in functions. The capabilities feature is **not** affected by this vulnerability.\n\n### For more information\n\nIf you have any questions or comments about this advisory:\n\n* Open an issue in [Community Discussions](https://github.com/open-policy-agent/community/discussions/categories/opa-and-rego)\n* Ask in Slack: https://slack.openpolicyagent.org/\n",
  "id": "GHSA-f524-rf33-2jjr",
  "modified": "2024-01-23T20:38:00Z",
  "published": "2022-09-16T17:42:47Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/open-policy-agent/opa/security/advisories/GHSA-f524-rf33-2jjr"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-36085"
    },
    {
      "type": "WEB",
      "url": "https://github.com/open-policy-agent/opa/pull/4540"
    },
    {
      "type": "WEB",
      "url": "https://github.com/open-policy-agent/opa/pull/4616"
    },
    {
      "type": "WEB",
      "url": "https://github.com/open-policy-agent/opa/commit/25a597bc3f4985162e7f65f9c36599f4f8f55823"
    },
    {
      "type": "WEB",
      "url": "https://github.com/open-policy-agent/opa/commit/3e8c754ed007b22393cf65e48751ad9f6457fee8"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/open-policy-agent/opa"
    },
    {
      "type": "WEB",
      "url": "https://github.com/open-policy-agent/opa/releases/tag/v0.43.1"
    },
    {
      "type": "WEB",
      "url": "https://pkg.go.dev/vuln/GO-2022-0978"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "OPA Compiler: Bypass of WithUnsafeBuiltins using \"with\" keyword to mock functions"
}

GSD-2022-36085

Vulnerability from gsd - Updated: 2023-12-13 01:19

Details

Aliases

CVE-2022-36085

Aliases

CVE-2022-36085

JSON

To clipboard

{
  "GSD": {
    "alias": "CVE-2022-36085",
    "description": "Open Policy Agent (OPA) is an open source, general-purpose policy engine. The Rego compiler provides a (deprecated) `WithUnsafeBuiltins` function, which allows users to provide a set of built-in functions that should be deemed unsafe \u2014 and as such rejected \u2014 by the compiler if encountered in the policy compilation stage. A bypass of this protection has been found, where the use of the `with` keyword to mock such a built-in function (a feature introduced in OPA v0.40.0), isn\u2019t taken into account by `WithUnsafeBuiltins`. Multiple conditions need to be met in order to create an adverse effect. Version 0.43.1 contains a patch for this issue. As a workaround, avoid using the `WithUnsafeBuiltins` function and use the `capabilities` feature instead.",
    "id": "GSD-2022-36085"
  },
  "gsd": {
    "metadata": {
      "exploitCode": "unknown",
      "remediation": "unknown",
      "reportConfidence": "confirmed",
      "type": "vulnerability"
    },
    "osvSchema": {
      "aliases": [
        "CVE-2022-36085"
      ],
      "details": "Open Policy Agent (OPA) is an open source, general-purpose policy engine. The Rego compiler provides a (deprecated) `WithUnsafeBuiltins` function, which allows users to provide a set of built-in functions that should be deemed unsafe \u2014 and as such rejected \u2014 by the compiler if encountered in the policy compilation stage. A bypass of this protection has been found, where the use of the `with` keyword to mock such a built-in function (a feature introduced in OPA v0.40.0), isn\u2019t taken into account by `WithUnsafeBuiltins`. Multiple conditions need to be met in order to create an adverse effect. Version 0.43.1 contains a patch for this issue. As a workaround, avoid using the `WithUnsafeBuiltins` function and use the `capabilities` feature instead.",
      "id": "GSD-2022-36085",
      "modified": "2023-12-13T01:19:21.796908Z",
      "schema_version": "1.4.0"
    }
  },
  "namespaces": {
    "cve.org": {
      "CVE_data_meta": {
        "ASSIGNER": "security-advisories@github.com",
        "ID": "CVE-2022-36085",
        "STATE": "PUBLIC",
        "TITLE": "OPA Compiler: Bypass of WithUnsafeBuiltins using `with` keyword to mock functions"
      },
      "affects": {
        "vendor": {
          "vendor_data": [
            {
              "product": {
                "product_data": [
                  {
                    "product_name": "opa",
                    "version": {
                      "version_data": [
                        {
                          "version_value": "\u003e= 0.40.0, \u003c 0.43.1"
                        }
                      ]
                    }
                  }
                ]
              },
              "vendor_name": "open-policy-agent"
            }
          ]
        }
      },
      "data_format": "MITRE",
      "data_type": "CVE",
      "data_version": "4.0",
      "description": {
        "description_data": [
          {
            "lang": "eng",
            "value": "Open Policy Agent (OPA) is an open source, general-purpose policy engine. The Rego compiler provides a (deprecated) `WithUnsafeBuiltins` function, which allows users to provide a set of built-in functions that should be deemed unsafe \u2014 and as such rejected \u2014 by the compiler if encountered in the policy compilation stage. A bypass of this protection has been found, where the use of the `with` keyword to mock such a built-in function (a feature introduced in OPA v0.40.0), isn\u2019t taken into account by `WithUnsafeBuiltins`. Multiple conditions need to be met in order to create an adverse effect. Version 0.43.1 contains a patch for this issue. As a workaround, avoid using the `WithUnsafeBuiltins` function and use the `capabilities` feature instead."
          }
        ]
      },
      "impact": {
        "cvss": {
          "attackComplexity": "HIGH",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 7.4,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
          "version": "3.1"
        }
      },
      "problemtype": {
        "problemtype_data": [
          {
            "description": [
              {
                "lang": "eng",
                "value": "CWE-693: Protection Mechanism Failure"
              }
            ]
          },
          {
            "description": [
              {
                "lang": "eng",
                "value": "CWE-20: Improper Input Validation"
              }
            ]
          }
        ]
      },
      "references": {
        "reference_data": [
          {
            "name": "https://github.com/open-policy-agent/opa/security/advisories/GHSA-f524-rf33-2jjr",
            "refsource": "CONFIRM",
            "url": "https://github.com/open-policy-agent/opa/security/advisories/GHSA-f524-rf33-2jjr"
          },
          {
            "name": "https://github.com/open-policy-agent/opa/pull/4540",
            "refsource": "MISC",
            "url": "https://github.com/open-policy-agent/opa/pull/4540"
          },
          {
            "name": "https://github.com/open-policy-agent/opa/pull/4616",
            "refsource": "MISC",
            "url": "https://github.com/open-policy-agent/opa/pull/4616"
          },
          {
            "name": "https://github.com/open-policy-agent/opa/commit/25a597bc3f4985162e7f65f9c36599f4f8f55823",
            "refsource": "MISC",
            "url": "https://github.com/open-policy-agent/opa/commit/25a597bc3f4985162e7f65f9c36599f4f8f55823"
          },
          {
            "name": "https://github.com/open-policy-agent/opa/commit/3e8c754ed007b22393cf65e48751ad9f6457fee8",
            "refsource": "MISC",
            "url": "https://github.com/open-policy-agent/opa/commit/3e8c754ed007b22393cf65e48751ad9f6457fee8"
          },
          {
            "name": "https://github.com/open-policy-agent/opa/releases/tag/v0.43.1",
            "refsource": "MISC",
            "url": "https://github.com/open-policy-agent/opa/releases/tag/v0.43.1"
          }
        ]
      },
      "source": {
        "advisory": "GHSA-f524-rf33-2jjr",
        "discovery": "UNKNOWN"
      }
    },
    "gitlab.com": {
      "advisories": [
        {
          "affected_range": "\u003e=0.40.0 \u003c0.43.1",
          "affected_versions": "All versions starting from 0.40.0 before 0.43.1",
          "cvss_v3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "cwe_ids": [
            "CWE-1035",
            "CWE-937"
          ],
          "date": "2022-09-16",
          "description": "Open Policy Agent (OPA) is an open source, general-purpose policy engine. The Rego compiler provides a (deprecated) `WithUnsafeBuiltins` function, which allows users to provide a set of built-in functions that should be deemed unsafe by the compiler if encountered in the policy compilation stage. A bypass of this protection has been found, where the use of the `with` keyword to mock such a built-in function (a feature introduced in OPA v0.40.0), is not taken into account by `WithUnsafeBuiltins`. Multiple conditions need to be met in order to create an adverse effect. Version 0.43.1 contains a patch for this issue. As a workaround, avoid using the `WithUnsafeBuiltins` function and use the `capabilities` feature instead.",
          "fixed_versions": [
            "0.43.1"
          ],
          "identifier": "CVE-2022-36085",
          "identifiers": [
            "GHSA-f524-rf33-2jjr",
            "CVE-2022-36085"
          ],
          "not_impacted": "All versions before 0.40.0, all versions starting from 0.43.1",
          "package_slug": "go/github.com/open-policy-agent/opa",
          "pubdate": "2022-09-16",
          "solution": "Upgrade to version 0.43.1 or above.",
          "title": "Protection Mechanism Failure",
          "urls": [
            "https://github.com/open-policy-agent/opa/security/advisories/GHSA-f524-rf33-2jjr",
            "https://nvd.nist.gov/vuln/detail/CVE-2022-36085",
            "https://github.com/open-policy-agent/opa/pull/4540",
            "https://github.com/open-policy-agent/opa/pull/4616",
            "https://github.com/open-policy-agent/opa/commit/25a597bc3f4985162e7f65f9c36599f4f8f55823",
            "https://github.com/open-policy-agent/opa/commit/3e8c754ed007b22393cf65e48751ad9f6457fee8",
            "https://github.com/open-policy-agent/opa/releases/tag/v0.43.1",
            "https://github.com/advisories/GHSA-f524-rf33-2jjr"
          ],
          "uuid": "a1834751-03d3-49aa-9e6d-5f463e13a97c"
        }
      ]
    },
    "nvd.nist.gov": {
      "configurations": {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:a:openpolicyagent:open_policy_agent:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "0.43.1",
                "versionStartIncluding": "0.40.0",
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      },
      "cve": {
        "CVE_data_meta": {
          "ASSIGNER": "security-advisories@github.com",
          "ID": "CVE-2022-36085"
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "en",
              "value": "Open Policy Agent (OPA) is an open source, general-purpose policy engine. The Rego compiler provides a (deprecated) `WithUnsafeBuiltins` function, which allows users to provide a set of built-in functions that should be deemed unsafe \u00e2\u20ac\u201d and as such rejected \u00e2\u20ac\u201d by the compiler if encountered in the policy compilation stage. A bypass of this protection has been found, where the use of the `with` keyword to mock such a built-in function (a feature introduced in OPA v0.40.0), isn\u00e2\u20ac\u2122t taken into account by `WithUnsafeBuiltins`. Multiple conditions need to be met in order to create an adverse effect. Version 0.43.1 contains a patch for this issue. As a workaround, avoid using the `WithUnsafeBuiltins` function and use the `capabilities` feature instead."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "en",
                  "value": "NVD-CWE-noinfo"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://github.com/open-policy-agent/opa/pull/4540",
              "refsource": "MISC",
              "tags": [
                "Exploit",
                "Patch",
                "Third Party Advisory"
              ],
              "url": "https://github.com/open-policy-agent/opa/pull/4540"
            },
            {
              "name": "https://github.com/open-policy-agent/opa/pull/4616",
              "refsource": "MISC",
              "tags": [
                "Exploit",
                "Patch",
                "Third Party Advisory"
              ],
              "url": "https://github.com/open-policy-agent/opa/pull/4616"
            },
            {
              "name": "https://github.com/open-policy-agent/opa/commit/3e8c754ed007b22393cf65e48751ad9f6457fee8",
              "refsource": "MISC",
              "tags": [
                "Patch",
                "Third Party Advisory"
              ],
              "url": "https://github.com/open-policy-agent/opa/commit/3e8c754ed007b22393cf65e48751ad9f6457fee8"
            },
            {
              "name": "https://github.com/open-policy-agent/opa/commit/25a597bc3f4985162e7f65f9c36599f4f8f55823",
              "refsource": "MISC",
              "tags": [
                "Patch",
                "Third Party Advisory"
              ],
              "url": "https://github.com/open-policy-agent/opa/commit/25a597bc3f4985162e7f65f9c36599f4f8f55823"
            },
            {
              "name": "https://github.com/open-policy-agent/opa/security/advisories/GHSA-f524-rf33-2jjr",
              "refsource": "CONFIRM",
              "tags": [
                "Exploit",
                "Patch",
                "Third Party Advisory"
              ],
              "url": "https://github.com/open-policy-agent/opa/security/advisories/GHSA-f524-rf33-2jjr"
            },
            {
              "name": "https://github.com/open-policy-agent/opa/releases/tag/v0.43.1",
              "refsource": "MISC",
              "tags": [
                "Third Party Advisory"
              ],
              "url": "https://github.com/open-policy-agent/opa/releases/tag/v0.43.1"
            }
          ]
        }
      },
      "impact": {
        "baseMetricV3": {
          "cvssV3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "exploitabilityScore": 3.9,
          "impactScore": 5.9
        }
      },
      "lastModifiedDate": "2022-09-13T21:15Z",
      "publishedDate": "2022-09-08T14:15Z"
    }
  }
}

FKIE_CVE-2022-36085

Vulnerability from fkie_nvd - Published: 2022-09-08 14:15 - Updated: 2024-11-21 07:12

Severity ?

7.4 (High) - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
9.8 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Summary

References

URL	Tags
security-advisories@github.com	https://github.com/open-policy-agent/opa/commit/25a597bc3f4985162e7f65f9c36599f4f8f55823	Patch, Third Party Advisory
security-advisories@github.com	https://github.com/open-policy-agent/opa/commit/3e8c754ed007b22393cf65e48751ad9f6457fee8	Patch, Third Party Advisory
security-advisories@github.com	https://github.com/open-policy-agent/opa/pull/4540	Exploit, Patch, Third Party Advisory
security-advisories@github.com	https://github.com/open-policy-agent/opa/pull/4616	Exploit, Patch, Third Party Advisory
security-advisories@github.com	https://github.com/open-policy-agent/opa/releases/tag/v0.43.1	Third Party Advisory
security-advisories@github.com	https://github.com/open-policy-agent/opa/security/advisories/GHSA-f524-rf33-2jjr	Exploit, Patch, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108	https://github.com/open-policy-agent/opa/commit/25a597bc3f4985162e7f65f9c36599f4f8f55823	Patch, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108	https://github.com/open-policy-agent/opa/commit/3e8c754ed007b22393cf65e48751ad9f6457fee8	Patch, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108	https://github.com/open-policy-agent/opa/pull/4540	Exploit, Patch, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108	https://github.com/open-policy-agent/opa/pull/4616	Exploit, Patch, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108	https://github.com/open-policy-agent/opa/releases/tag/v0.43.1	Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108	https://github.com/open-policy-agent/opa/security/advisories/GHSA-f524-rf33-2jjr	Exploit, Patch, Third Party Advisory

Impacted products

	Vendor	Product	Version
	openpolicyagent	open_policy_agent	*

JSON

To clipboard

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:openpolicyagent:open_policy_agent:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "24044142-C7B3-4994-9F36-5ED0299C8E5B",
              "versionEndExcluding": "0.43.1",
              "versionStartIncluding": "0.40.0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Open Policy Agent (OPA) is an open source, general-purpose policy engine. The Rego compiler provides a (deprecated) `WithUnsafeBuiltins` function, which allows users to provide a set of built-in functions that should be deemed unsafe \u2014 and as such rejected \u2014 by the compiler if encountered in the policy compilation stage. A bypass of this protection has been found, where the use of the `with` keyword to mock such a built-in function (a feature introduced in OPA v0.40.0), isn\u2019t taken into account by `WithUnsafeBuiltins`. Multiple conditions need to be met in order to create an adverse effect. Version 0.43.1 contains a patch for this issue. As a workaround, avoid using the `WithUnsafeBuiltins` function and use the `capabilities` feature instead."
    },
    {
      "lang": "es",
      "value": "Open Policy Agent (OPA) es un motor de pol\u00edticas de prop\u00f3sito general de c\u00f3digo abierto.\u0026#xa0;El compilador de Rego proporciona una funci\u00f3n \"WithUnsafeBuiltins\" (en desuso), que permite a usuarios proporcionar un conjunto de funciones integradas que el compilador deber\u00eda considerar inseguras y, como tales, rechazarlas si son encontradas en la etapa de compilaci\u00f3n de pol\u00edticas. .\u0026#xa0;Se ha encontrado una omisi\u00f3n de esta protecci\u00f3n, en la que \"WithUnsafeBuiltins\" no es tenido en cuenta el uso de la palabra clave \"with\" para simular una funci\u00f3n integrada de este tipo (una caracter\u00edstica introducida en OPA v0.40.0).\u0026#xa0;Deben cumplirse m\u00faltiples condiciones para crear un efecto adverso.\u0026#xa0;La versi\u00f3n 0.43.1 contiene un parche para este problema.\u0026#xa0;Como mitigaci\u00f3n, evite usar la funci\u00f3n \"WithUnsafeBuiltins\" y use la funcionalidad \"capabilities\" en su lugar"
    }
  ],
  "id": "CVE-2022-36085",
  "lastModified": "2024-11-21T07:12:21.110",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "HIGH",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 7.4,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.2,
        "impactScore": 5.2,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      },
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 9.8,
          "baseSeverity": "CRITICAL",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 5.9,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2022-09-08T14:15:08.340",
  "references": [
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Patch",
        "Third Party Advisory"
      ],
      "url": "https://github.com/open-policy-agent/opa/commit/25a597bc3f4985162e7f65f9c36599f4f8f55823"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Patch",
        "Third Party Advisory"
      ],
      "url": "https://github.com/open-policy-agent/opa/commit/3e8c754ed007b22393cf65e48751ad9f6457fee8"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Exploit",
        "Patch",
        "Third Party Advisory"
      ],
      "url": "https://github.com/open-policy-agent/opa/pull/4540"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Exploit",
        "Patch",
        "Third Party Advisory"
      ],
      "url": "https://github.com/open-policy-agent/opa/pull/4616"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://github.com/open-policy-agent/opa/releases/tag/v0.43.1"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Exploit",
        "Patch",
        "Third Party Advisory"
      ],
      "url": "https://github.com/open-policy-agent/opa/security/advisories/GHSA-f524-rf33-2jjr"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch",
        "Third Party Advisory"
      ],
      "url": "https://github.com/open-policy-agent/opa/commit/25a597bc3f4985162e7f65f9c36599f4f8f55823"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch",
        "Third Party Advisory"
      ],
      "url": "https://github.com/open-policy-agent/opa/commit/3e8c754ed007b22393cf65e48751ad9f6457fee8"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Exploit",
        "Patch",
        "Third Party Advisory"
      ],
      "url": "https://github.com/open-policy-agent/opa/pull/4540"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Exploit",
        "Patch",
        "Third Party Advisory"
      ],
      "url": "https://github.com/open-policy-agent/opa/pull/4616"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://github.com/open-policy-agent/opa/releases/tag/v0.43.1"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Exploit",
        "Patch",
        "Third Party Advisory"
      ],
      "url": "https://github.com/open-policy-agent/opa/security/advisories/GHSA-f524-rf33-2jjr"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-20"
        },
        {
          "lang": "en",
          "value": "CWE-693"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    },
    {
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-noinfo"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CVE-2022-36085 (GCVE-0-2022-36085)

GHSA-F524-RF33-2JJR

Impact

Affected Users

Patches

Workarounds

References

For more information

GSD-2022-36085

FKIE_CVE-2022-36085

Tags

Sightings

Nomenclature