Cedar: JSON template is in scope missing slot-id validation allows link panic and decision divergence
Cedar users must be using all of the following features to be affected by this advisory: JSON format policies, policy templates, and the `is in` scope condition. This advisory only affects JSON-formatted Cedar policy templates containing `is in` scope conditions that are **malformed** according to the Cedar syntax. It does **not** affect syntactically well-formed policies. Users of Cedar who author policies in the JSON format were able to write Cedar policies using the `is in` condition with an incorrect slot identifier in the principal and resource scope constraints (e.g., `?principal` in the resource scope constraint) even though this is n
- Обновитесь до 3.4.3
- Обновитесь до 4.11.1
Опубликовано Обновлено