Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
3 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
Go github.com/nats-io/nats-streaming-server < 0.24.6
Fixed in
0.24.6· Vendor fix available
Issue
NATS.io NATS Server before 2.8.2 and Streaming Server before 0.24.6 could allow a remote attacker to bypass security restrictions, caused by the failure to enforce negative user permissions in one scenario. By using a queue subscription on the wildcard, an attacker could exploit this vulnerability to allow denied subjects.
Recommended action: Upgrade to 0.24.6 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Go github.com/nats-io/nats-streaming-server >= 0.15.0, < 0.24.3
Fixed in
0.24.3· Vendor fix available
Issue
(This document is canonically: <https://advisories.nats.io/CVE/CVE-2022-26652.txt) Background NATS.io is a high performance open source pub-sub distributed communication technology, built for the cloud, on-premise, IoT, and edge computing. JetStream is the optional RAFT-based resilient persistent feature of NATS. Problem Description The JetStream streams can be backed up and restored via NATS. The backup format is a tar archive file. Inadequate checks on the filenames within the archive file permit a so-called "Zip Slip" attack in the stream restore. NATS nats-server through 2022-03-09 (fixed in release 2.7.4) did not correctly sanitize elements of the archive file, thus a user of NATS could cause the NATS server to write arbitrary content to an attacker-controlled filename. Affected versions NATS Server: 2.2.0 up to and including 2.7.3. + Introduced with JetStream Restore functionality Fixed with nats-io/nats-server: 2.7.4 Docker image: nats <https://hub.docker.com//nats NB users of…
Recommended action: Upgrade to 0.24.3 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Go github.com/nats-io/nats-streaming-server >= 0.15.0, < 0.24.1
Fixed in
0.24.1· Vendor fix available
Issue
(This advisory is canonically <https://advisories.nats.io/CVE/CVE-2022-24450.txt) Problem Description NATS nats-server through 2022-02-04 has Incorrect Access Control, with unchecked ability for clients to authorize into any account, because of a coding error in a long-extant experimental feature. A client crafting the initial protocol-level handshake could, with valid credentials for any account, specify a target account and switch into it immediately. This includes any other tenant, and includes the System account which controls nats-server core operations. For deployments not using multi-tenancy through NATS Accounts, there is still a vulnerability: normal users are able to choose to be in the System account. An experimental feature to provide dynamically provisioned sandbox accounts was designed to allow a server administrator to turn on an option to allow clients to dynamically request a brand new account inline at connection time. This feature went nowhere, but lived on in the…
Recommended action: Upgrade to 0.24.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.