Lucene search

[email protected]CVE-2020-28466

HistoryMar 07, 2021 - 10:15 a.m.

CVE-2020-28466

2021-03-0710:15:12

[email protected]

web.nvd.nist.gov

cve

2020

28466

github

nats-io

nats-server

server

untrusted accounts

crash

configs

service

export

import

cycles

remote execution

denial-of-service

flaws

prompt fixes

nats

maintainers

caution

regular building

git

5 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:N/A:P

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

0.019 Low

EPSS

Percentile

88.6%

JSON

This affects all versions of package github.com/nats-io/nats-server/server. Untrusted accounts are able to crash the server using configs that represent a service export/import cycles. Disclaimer from the maintainers: Running a NATS service which is exposed to untrusted users presents a heightened risk. Any remote execution flaw or equivalent seriousness, or denial-of-service by unauthenticated users, will lead to prompt releases by the NATS maintainers. Fixes for denial of service issues with no threat of remote execution, when limited to account holders, are likely to just be committed to the main development branch with no special attention. Those who are running such services are encouraged to build regularly from git.

Affected configurations

NVD

Node

natsnats_serverRange2.0.0–2.2.0

CPENameOperatorVersion
nats:nats_servernats nats serverlt2.2.0

CPE	Name	Operator	Version
nats:nats_server	nats nats server	lt	2.2.0

CNA Affected

[
  {
    "product": "github.com/nats-io/nats-server/server",
    "vendor": "n/a",
    "versions": [
      {
        "lessThan": "unspecified",
        "status": "affected",
        "version": "0",
        "versionType": "custom"
      }
    ]
  }
]