Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
3 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
CedarJava is an open source Java implementation of the Cedar policy language, used for fine-grained authorization decisions. Under certain circumstances, it could lead to incorrect equality comparisons. Impact EntityIdentifier.equals() has inverted null/self branches The EntityIdentifier.equals() method has inverted logic for null and self-reference checks, returning true for null comparisons and false for self-comparisons. This does not affect Cedar authorization decisions (computed in Rust from JSON), but could affect integrators who perform their own equality checks on entity identifiers. Impacted versions: < 4.9 Patches It has been addressed in CedarJava version 4.9 and above. We recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes. Workarounds Avoid relying on EntityIdentifier.equals() for security-sensitive comparisons until upgraded to version 4.9. References If you have any questions or comments…
Recommended action: Upgrade to 4.9.0, 3.4.1 or 2.3.6 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
CedarJava is an open source Java implementation of the Cedar policy language, used for fine-grained authorization decisions. Under certain circumstances, improper input handling could allow policy injection. Impact Cedar-expression injection via unescaped toCedarExpr() The toCedarExpr() method on Cedar Value types does not escape special characters (" or \) when converting values to Cedar source code. If an integrator uses toCedarExpr() to build policy text at runtime from user-controlled values, an actor could inject arbitrary Cedar expressions. For example, injecting || true into a permit ... when { ... } clause could make the permit unconditional, or injecting && false into a forbid clause could prevent the forbid from triggering. This issue requires the integrator to use toCedarExpr() to build policy text at runtime from user-controlled input. Impacted versions: < 4.9 Patches Addressed in CedarJava version 2.3.6, 3.4.1, and 4.9 and above. We recommend upgrading to the…
Recommended action: Upgrade to 4.9.0, 3.4.1 or 2.3.6 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
CedarJava is an open source Java implementation of the Cedar policy language, used for fine-grained authorization decisions. Under certain circumstances, improper input handling could allow type confusion across the Java-Rust FFI boundary. Impact Record-to-Entity type confusion across the Java-Rust FFI boundary CedarJava sends authorization requests to the Rust cedar-policy evaluator as JSON. The JSON protocol reserves magic single-key object shapes (entity and extn) for entity references and extension values. When serializing a CedarMap, there is no validation preventing these reserved keys from being used. If an integrating service builds a CedarMap from caller-supplied key/value data (such as request headers, user-defined metadata, or resource tags), an actor who controls those keys could cause the Rust evaluator to interpret a record as an entity reference. This issue requires the integrating service to build a CedarMap where the an actor controls the keys, and a policy…
Recommended action: Upgrade to 4.9.0, 3.4.1 or 2.3.6 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.