CedarJava vulnerabilities

In CedarJava library versions prior to 2.3.6, 3.4.1, and 4.9.0, a vulnerability allows Cedar-expression injection due to improper input handling. The toCedarExpr() method does not escape special characters, enabling injection of arbitrary policy expressions.

In CedarJava versions prior to 4.9.0, the EntityIdentifier.equals() method has inverted logic for null and self-reference checks, causing incorrect equality comparisons. This does not affect Cedar authorization decisions but may impact integrators performing their own entity identifier comparisons.

CedarJava prior to versions 2.3.6, 3.4.1 and 4.9.0 contains a vulnerability where improper input handling could allow Record-to-Entity type confusion across the Java-Rust FFI boundary. CedarJava sends authorization requests to the Rust cedar-policy evaluator as JSON. The JSON protocol reserves magic single-key object shapes (__entity and __extn) for entity references and extension values. When serializing a CedarMap, there is no validation preventing these reserved keys from being used. If an integrating service builds a CedarMap from caller-supplied key/value data (such as request headers, user-defined metadata, or resource tags), an actor who controls those keys could cause the Rust evaluator to interpret a record as an entity reference. This vulnerability has been fixed in versions 2.3.6, 3.4.1, and 4.9.