Low, CVSS 2.1crates.ioAmendedPublished
Cedar: JSON template is in scope missing slot-id validation allows link panic and decision divergence
GHSA-c33x-vcv4-vg3g
- Affected
- crates.io cedar-policy >= 4.0.0, < 4.11.1; >= 3.0.0, < 3.4.3
- Fixed in
- 4.11.13.4.3· Vendor fix available
- Issue
- Cedar users must be using all of the following features to be affected by this advisory: JSON format policies, policy templates, and the `is in` scope condition. This advisory only affects JSON-formatted Cedar policy templates containing `is in` scope conditions that are malformed according to the Cedar syntax. It does not affect syntactically well-formed policies. Users of Cedar who author policies in the JSON format were able to write Cedar policies using the `is in` condition with an incorrect slot identifier in the principal and resource scope constraints (e.g., `?principal` in the resource scope constraint) even though this is not allowed when parsing policies from the Cedar policy syntax. Internally, the slot identifiers were silently corrected (e.g. `?resource` is placed in the resource scope constraint). If the policy contains *exactly one slot* in either the principal or resource position, then any attempt to create a linked policy from the template results in an…
Recommended action: Upgrade to 4.11.1 or 3.4.3 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.