CVE-2022-28946 Out of bounds memory access in github.com/open-policy-agent/opa

What is CVE-2022-28946?

CVE-2022-28946 is a high-severity denial of service vulnerability in n/a, published on 19 May 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

An issue in the component ast/parser.go of Open Policy Agent v0.39.0 causes the application to incorrectly interpret every expression, causing a Denial of Service (DoS) via triggering out-of-range memory access.

Which versions are affected by CVE-2022-28946?

3 open source packages ship an affected version, including github.com/open-policy-agent/opa. It affects 1 product.

Products include Openpolicyagent Open Policy Agent.

How do I fix CVE-2022-28946?

Upgrade github.com/open-policy-agent/opa to 0.40.0 or later.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2022-28946 being exploited?

There is no known exploitation of CVE-2022-28946 in the wild and no public exploit code.

Other vulnerabilities in n/a

• CVE-2022-33082 Denial of service in Open Policy Agent High 7.5
• CVE-2022-36085 OPA Compiler: Bypass of WithUnsafeBuiltins using `with` keyword to mock functions High 7.4
• CVE-2022-23628 Array literal misordering in github.com/open-policy-agent/opa Medium 6.3
• CVE-2024-8260 OPA SMB Force-Authentication Medium 6.1

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-x7f3-62pm-9p38, GO-2022-0587, openSUSE-SU-2024:12102-1, openSUSE-SU-2024:12128-1.