CyberRota Analysis
AI-GeneratedCedarJava versions prior to 4.9.0 contain a flaw in the EntityIdentifier.equals() method, where inverted null and self-reference checks can lead to incorrect equality comparisons. While this vulnerability does not impact Cedar's authorization decisions, it poses a risk to integrators relying on custom equality checks for entity identifiers. Organizations using affected versions should prioritize upgrading to 4.9.0 to mitigate potential integration issues.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
CedarJava is an open source Java implementation of the Cedar policy language, used for fine-grained authorization decisions. In versions prior to 4.9.0, the EntityIdentifier.equals() has inverted null/self branches which could lead to incorrect equality comparisons. The EntityIdentifier.equals() method has inverted logic for null and self-reference checks, returning true for null comparisons and false for self-comparisons. This does not affect Cedar authorization decisions (computed in Rust from JSON), but could affect integrators who perform their own equality checks on entity identifiers. This issue has been fixed in version 4.9.0.