local-it/mitgliederverwaltung
local-it/mitgliederverwaltung
2
3
Fork 0
Code Issues 58 Pull requests 7 Projects 1 Releases 6 Packages 1 Activity Actions

chore(deps): update dependency ash to v3.34.6 [security] - autoclosed #574

Closed
renovate wants to merge 1 commit from renovate/hex-ash-vulnerability into main
pull from: renovate/hex-ash-vulnerability
merge into: local-it:main
Conversation 0 Commits 1 Files changed 1 +21 -21
renovate commented 2026-10-08 14:22:44 +02:00
Collaborator
Copy link

This PR contains the following updates:

Package Type Update Change
ash (source) prod patch 3.34.1 → 3.34.6

Filtering an :atom attribute with unsafe_to_atom? can exhaust the BEAM atom table in Ash

CVE-2026-94201 / EEF-CVE-2026-94201

More information

Details

Summary

Ash stores :atom-typed attributes as strings and compares them as strings. When such an attribute is referenced in a filter, the comparison value is coerced through Ash.Type.Atom. Because the type defined no coerce/2 callback, coercion fell back to the default (cast_input/2), which calls String.to_atom/1 when the attribute is configured with the unsafe_to_atom?: true constraint.

Filtering such an attribute with attacker-controlled strings therefore interned a new, permanent atom for every distinct value. Atoms are never garbage collected and the BEAM caps the atom table, so an actor who can supply filter values for a public, filterable :atom attribute declared with unsafe_to_atom?: true can exhaust the atom table and crash the node (denial of service). AshPaperTrail is a notable example: its version resources expose a public, filterable version_action_name atom attribute with unsafe_to_atom?: true by default.

The fix adds a coerce/2 to Ash.Type.Atom that never interns atoms — a comparison value is left as a string, since the type is stored and compared as a string. Setting the attribute from action input (cast_input/2, which still honors unsafe_to_atom?) is unchanged.

This issue affects ash: from 3.5.1 before 3.34.3.

Configurations

Reachable only when an application exposes a public, filterable :atom attribute declared with the unsafe_to_atom?: true constraint, and an actor can supply filter values for it (for example through AshGraphql, AshJsonApi, or Ash.Query.filter_input/2). AshPaperTrail's version resources ship such an attribute (version_action_name) by default.

Severity

  • CVSS Score: 8.2 / 10 (High)
  • Vector String: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

References

This data is provided by OSV.

Ash.count, Ash.exists and Ash.aggregate skip related resources' read policies in filters and sorts

CVE-2026-101028 / EEF-CVE-2026-101028 / GHSA-xj24-8f5c-pp5p

More information

Details

Summary

Incorrect Authorization vulnerability in ash-project ash allows an actor to infer data in related records they cannot read via Ash.count/2, Ash.exists/2 and Ash.aggregate/3.

Ash.Actions.Aggregate.run/4 (lib/ash/actions/aggregate.ex) applied only the root resource's read policy before running the aggregate query. The read path also applies each related resource's read policy to filter and sort references that cross a relationship, directly (for example comments.body) or through an aggregate over one, but the aggregate path skipped that step. A caller whose filter or sort reaches these functions, for example through Ash.Query.filter_input/2, an ash_lua script, or an AshAi tool offering count or exists results, can test conditions against related rows hidden from them and recover their existence and attribute values one query at a time. Ash.read/2 and its page counts are not affected.

This issue affects ash: from 2.6.0 before 3.34.6.

Configurations

Reachable only when an application passes caller-supplied filters or sorts that cross a relationship into Ash.count/2, Ash.exists/2 or Ash.aggregate/3 (directly, through ash_lua read operations, or through AshAi count, exists or aggregate result types), and a related resource's read policy is stricter than the root resource's.

Severity

  • CVSS Score: 6.0 / 10 (Medium)
  • Vector String: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

References

This data is provided by OSV.

Release Notes

ash-project/ash (ash)

v3.34.6

Compare Source

Bug Fixes:

v3.34.5

Compare Source

Improvements:
Bug Fixes:

v3.34.4

Compare Source

Improvements:

v3.34.3

Compare Source

Bug Fixes:

Fixes CVE-2026-94201

  • track calculation nullability through dynamic calculations by @​zachdaniel

  • handle defaults in aggregate nullability for manifests by @​zachdaniel

v3.34.2

Compare Source

Performance Improvements:

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate.

This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [ash](https://hex.pm/packages/ash) ([source](https://github.com/ash-project/ash)) | prod | patch | `3.34.1` → `3.34.6` | --- ### Filtering an :atom attribute with unsafe_to_atom? can exhaust the BEAM atom table in Ash [CVE-2026-94201](https://nvd.nist.gov/vuln/detail/CVE-2026-94201) / EEF-CVE-2026-94201 <details> <summary>More information</summary> #### Details ##### Summary Ash stores `:atom`-typed attributes as strings and compares them as strings. When such an attribute is referenced in a filter, the comparison value is coerced through `Ash.Type.Atom`. Because the type defined no `coerce/2` callback, coercion fell back to the default (`cast_input/2`), which calls `String.to_atom/1` when the attribute is configured with the `unsafe_to_atom?: true` constraint. Filtering such an attribute with attacker-controlled strings therefore interned a new, permanent atom for every distinct value. Atoms are never garbage collected and the BEAM caps the atom table, so an actor who can supply filter values for a public, filterable `:atom` attribute declared with `unsafe_to_atom?: true` can exhaust the atom table and crash the node (denial of service). AshPaperTrail is a notable example: its version resources expose a public, filterable `version_action_name` atom attribute with `unsafe_to_atom?: true` by default. The fix adds a `coerce/2` to `Ash.Type.Atom` that never interns atoms — a comparison value is left as a string, since the type is stored and compared as a string. Setting the attribute from action input (`cast_input/2`, which still honors `unsafe_to_atom?`) is unchanged. This issue affects ash: from 3.5.1 before 3.34.3. ##### Configurations Reachable only when an application exposes a public, filterable `:atom` attribute declared with the `unsafe_to_atom?: true` constraint, and an actor can supply filter values for it (for example through AshGraphql, AshJsonApi, or `Ash.Query.filter_input/2`). AshPaperTrail's version resources ship such an attribute (`version_action_name`) by default. #### Severity - CVSS Score: 8.2 / 10 (High) - Vector String: `CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N` #### References - [https://cna.erlef.org/cves/CVE-2026-94201.html](https://cna.erlef.org/cves/CVE-2026-94201.html) - [https://github.com/ash-project/ash/commit/2970ba3bd5d36d6ad04c731ac87385375d457147](https://github.com/ash-project/ash/commit/2970ba3bd5d36d6ad04c731ac87385375d457147) - [https://github.com/ash-project/ash/commit/5282f3f513053628cdd1bf2236ea22d975d934d4](https://github.com/ash-project/ash/commit/5282f3f513053628cdd1bf2236ea22d975d934d4) - [https://hex.pm/packages/ash](https://hex.pm/packages/ash) This data is provided by [OSV](https://osv.dev/vulnerability/EEF-CVE-2026-94201). </details> --- ### Ash.count, Ash.exists and Ash.aggregate skip related resources' read policies in filters and sorts [CVE-2026-101028](https://nvd.nist.gov/vuln/detail/CVE-2026-101028) / EEF-CVE-2026-101028 / [GHSA-xj24-8f5c-pp5p](https://github.com/advisories/GHSA-xj24-8f5c-pp5p) <details> <summary>More information</summary> #### Details ##### Summary Incorrect Authorization vulnerability in ash-project ash allows an actor to infer data in related records they cannot read via `Ash.count/2`, `Ash.exists/2` and `Ash.aggregate/3`. `Ash.Actions.Aggregate.run/4` (`lib/ash/actions/aggregate.ex`) applied only the root resource's read policy before running the aggregate query. The read path also applies each related resource's read policy to filter and sort references that cross a relationship, directly (for example `comments.body`) or through an aggregate over one, but the aggregate path skipped that step. A caller whose filter or sort reaches these functions, for example through `Ash.Query.filter_input/2`, an ash_lua script, or an AshAi tool offering count or exists results, can test conditions against related rows hidden from them and recover their existence and attribute values one query at a time. `Ash.read/2` and its page counts are not affected. This issue affects ash: from 2.6.0 before 3.34.6. ##### Configurations Reachable only when an application passes caller-supplied filters or sorts that cross a relationship into `Ash.count/2`, `Ash.exists/2` or `Ash.aggregate/3` (directly, through ash_lua read operations, or through AshAi count, exists or aggregate result types), and a related resource's read policy is stricter than the root resource's. #### Severity - CVSS Score: 6.0 / 10 (Medium) - Vector String: `CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N` #### References - [https://github.com/ash-project/ash/security/advisories/GHSA-xj24-8f5c-pp5p](https://github.com/ash-project/ash/security/advisories/GHSA-xj24-8f5c-pp5p) - [https://cna.erlef.org/cves/CVE-2026-101028.html](https://cna.erlef.org/cves/CVE-2026-101028.html) - [https://github.com/ash-project/ash/commit/30eaf1c6e8524527b703e3c4bfeff7967ee0b37c](https://github.com/ash-project/ash/commit/30eaf1c6e8524527b703e3c4bfeff7967ee0b37c) - [https://github.com/ash-project/ash/commit/80936187b27ee94f15cd875affd3141b5cb23185](https://github.com/ash-project/ash/commit/80936187b27ee94f15cd875affd3141b5cb23185) - [https://hex.pm/packages/ash](https://hex.pm/packages/ash) This data is provided by [OSV](https://osv.dev/vulnerability/EEF-CVE-2026-101028). </details> --- ### Release Notes <details> <summary>ash-project/ash (ash)</summary> ### [`v3.34.6`](https://github.com/ash-project/ash/blob/HEAD/CHANGELOG.md#v3346-2026-10-09) [Compare Source](https://github.com/ash-project/ash/compare/v3.34.5...v3.34.6) ##### Bug Fixes: - \[security] apply related resources' read policies to filters and sorts in `Ash.count/2`, `Ash.exists/2` and `Ash.aggregate/3` ([CVE-2026-101028](https://cna.erlef.org/cves/CVE-2026-101028.html), [GHSA-xj24-8f5c-pp5p](https://github.com/ash-project/ash/security/advisories/GHSA-xj24-8f5c-pp5p)) by [@&#8203;zachdaniel](https://github.com/zachdaniel) - correct type casting in operators by [@&#8203;zachdaniel](https://github.com/zachdaniel) - match embedded resource structs in equal? without expanding them ([#&#8203;3006](https://github.com/ash-project/ash/issues/3006)) by Moxley Stratton [(#&#8203;3006)](https://github.com/ash-project/ash/pull/3006) ### [`v3.34.5`](https://github.com/ash-project/ash/blob/HEAD/CHANGELOG.md#v3345-2026-10-08) [Compare Source](https://github.com/ash-project/ash/compare/v3.34.4...v3.34.5) ##### Improvements: - normalize all notification return shapes by [@&#8203;zachdaniel](https://github.com/zachdaniel) [(#&#8203;2991)](https://github.com/ash-project/ash/pull/2991) ##### Bug Fixes: - field policy related filter fix ([#&#8203;3002](https://github.com/ash-project/ash/issues/3002)) by Moxley Stratton [(#&#8203;3002)](https://github.com/ash-project/ash/pull/3002) - refuse a read as\_of that names no instant, rather than raising FunctionClauseError ([#&#8203;2999](https://github.com/ash-project/ash/issues/2999)) by [@&#8203;matt-beanland](https://github.com/matt-beanland) [(#&#8203;2999)](https://github.com/ash-project/ash/pull/2999) - hold a temporal write's as\_of to its period's type and constraints ([#&#8203;2997](https://github.com/ash-project/ash/issues/2997)) by [@&#8203;matt-beanland](https://github.com/matt-beanland) [(#&#8203;2997)](https://github.com/ash-project/ash/pull/2997) - make every temporal write as of one instant Ash resolves ([#&#8203;2995](https://github.com/ash-project/ash/issues/2995)) by [@&#8203;matt-beanland](https://github.com/matt-beanland) [(#&#8203;2995)](https://github.com/ash-project/ash/pull/2995) - compare embedded resources attribute by attribute by [@&#8203;zachdaniel](https://github.com/zachdaniel) [(#&#8203;2993)](https://github.com/ash-project/ash/pull/2993) - compare embedded resources attribute by attribute by [@&#8203;padde](https://github.com/padde) [(#&#8203;2993)](https://github.com/ash-project/ash/pull/2993) ### [`v3.34.4`](https://github.com/ash-project/ash/blob/HEAD/CHANGELOG.md#v3344-2026-10-04) [Compare Source](https://github.com/ash-project/ash/compare/v3.34.3...v3.34.4) ##### Improvements: - allow opting out of `run` compile time dependencies by [@&#8203;zachdaniel](https://github.com/zachdaniel) ### [`v3.34.3`](https://github.com/ash-project/ash/blob/HEAD/CHANGELOG.md#v3343-2026-10-04) [Compare Source](https://github.com/ash-project/ash/compare/v3.34.2...v3.34.3) ##### Bug Fixes: - don't create atoms when filtering on an atom by [@&#8203;zachdaniel](https://github.com/zachdaniel) Fixes CVE-2026-94201 - track calculation nullability through dynamic calculations by [@&#8203;zachdaniel](https://github.com/zachdaniel) - handle defaults in aggregate nullability for manifests by [@&#8203;zachdaniel](https://github.com/zachdaniel) ### [`v3.34.2`](https://github.com/ash-project/ash/blob/HEAD/CHANGELOG.md#v3342-2026-10-04) [Compare Source](https://github.com/ash-project/ash/compare/v3.34.1...v3.34.2) ##### Performance Improvements: - less compile time dependencies for policies by [@&#8203;zachdaniel](https://github.com/zachdaniel) </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xNjUuMiIsInVwZGF0ZWRJblZlciI6IjQzLjE2NS4yIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJhdXRvbWF0ZWQiLCJkZXBlbmRlbmNpZXMiLCJyZW5vdmF0ZSIsInNlY3VyaXR5Il19-->
chore(deps): update dependency ash to v3.34.3 [security]
Some checks failed
continuous-integration/drone/push Build is failing
Details
77f3da603f
renovate force-pushed renovate/hex-ash-vulnerability from 77f3da603f
Some checks failed
continuous-integration/drone/push Build is failing
Details
to 7655a432be
Some checks failed
continuous-integration/drone/push Build is failing
Details
2026-10-08 21:22:59 +02:00 Compare
renovate force-pushed renovate/hex-ash-vulnerability from 7655a432be
Some checks failed
continuous-integration/drone/push Build is failing
Details
to 19f9f95331
All checks were successful
continuous-integration/drone/push Build is passing
Details
2026-10-10 02:02:19 +02:00 Compare
renovate changed title from chore(deps): update dependency ash to v3.34.3 [security] to chore(deps): update dependency ash to v3.34.6 [security] 2026-10-10 02:02:29 +02:00
renovate force-pushed renovate/hex-ash-vulnerability from 19f9f95331
All checks were successful
continuous-integration/drone/push Build is passing
Details
to de6e687ad6
All checks were successful
continuous-integration/drone/push Build is passing
Details
2026-10-11 02:02:39 +02:00 Compare
renovate force-pushed renovate/hex-ash-vulnerability from de6e687ad6
All checks were successful
continuous-integration/drone/push Build is passing
Details
to 0534411e4d
All checks were successful
continuous-integration/drone/push Build is passing
Details
2026-10-12 02:02:25 +02:00 Compare
renovate changed title from chore(deps): update dependency ash to v3.34.6 [security] to chore(deps): update dependency ash to v3.34.6 [security] - autoclosed 2026-10-12 12:14:40 +02:00
renovate closed this pull request 2026-10-12 12:14:40 +02:00
Some checks are pending
continuous-integration/drone/push Build is passing
Details
continuous-integration/drone/promote/production
Required

Pull request closed

This pull request cannot be reopened because the branch was deleted.
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels   
bug
Something is not working

  
duplicate
This issue or pull request already exists

  
enhancement
New feature

  
help wanted
Need some help

  
high priority

   
invalid
Something is wrong

  
L
5 h

  
low priority

   
M
3 h

  
medium priority

   
needs refinement

   
optional

   
question
More information is needed

  
S
1 h

  
security

   
technical improvement

   
UX Improvement

   
wontfix
This won't be fixed

No labels
bug
duplicate
enhancement
help wanted
high priority
invalid
L
low priority
M
medium priority
needs refinement
optional
question
S
security
technical improvement
UX Improvement
wontfix
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
local-it/mitgliederverwaltung!574
No description provided.