598 matches found
CVE-2023-47090
CVE-2023-47090 : The NATS nats-server authentication bypass affects 2.9.23 and 2.10.x before 2.10.2; an implicit "$G" user in an authorization block can allow unauthenticated access, even if accounts exist. Earliest affected version is 2.2.0. The connected IBM / OSS advisories confirm the vulnera...
CVE-2023-47090
NATS nats-server before 2.9.23 and 2.10.x before 2.10.2 has an authentication bypass. An implicit $G user in an authorization block can sometimes be used for unauthenticated access, even when the intention of the configuration was for each user to have an account. The earliest affected version is...
CVE-2023-47090
NATS nats-server before 2.9.23 and 2.10.x before 2.10.2 has an authentication bypass. An implicit $G user in an authorization block can sometimes be used for unauthenticated access, even when the intention of the configuration was for each user to have an account. The earliest affected version is...
CVE-2023-47090
NATS nats-server before 2.9.23 and 2.10.x before 2.10.2 has an authentication bypass. An implicit $G user in an authorization block can sometimes be used for unauthenticated access, even when the intention of the configuration was for each user to have an account. The earliest affected version is...
PT-2023-29861 · Unknown +1 · Nats Server +1
Name of the Vulnerable Software and Affected Versions: nkeys versions 0.4.0 through 0.4.5 NATS Server versions 2.10.0 through 2.10.3 Description: NATS.io is a high performance open source pub-sub distributed communication technology. The cryptographic key handling library, nkeys, recently gained...
Nats-Server Security Vulnerability
Nats-Server is a high performance server for Nats.io, cloud and edge native messaging systems. A security vulnerability exists in Nats-Server versions prior to 2.9.23, and 2.10.x prior to 2.10.2, which stems from the presence of an authentication bypass that allows an attacker to bypass...
CVE-2023-47090
NATS nats-server before 2.9.23 and 2.10.x before 2.10.2 has an authentication bypass. An implicit $G user in an authorization block can sometimes be used for unauthenticated access, even when the intention of the configuration was for each user to have an account. The earliest affected version is...
NATS Server Security Vulnerability
NATS Server is an open source messaging system. The system is primarily used for cloud-native applications, IoT messaging, and microservice architectures. A security vulnerability exists in NATS Server versions 2.10.0 through 2.10.3, and nkeys versions 0.4.0 through 0.4.5, which stems from the...
Fedora: Security Advisory for nats-server (FEDORA-2023-c33188f575)
The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
GO-2023-2133 Authorization bypass in github.com/nats-io/nats-server/v2
Without any authorization rules in the nats-server, users can connect without authentication. Before nats-server 2.2.0, all authentication and authorization rules for a nats-server lived in an "authorization" block, defining users. With nats-server 2.2.0 all users live inside accounts. When using...
[SECURITY] Fedora 38 Update: nats-server-2.10.3-1.fc38
A High Performance NATS Server written in Go and hosted by the Cloud Native Computing Foundation CNCF...
Fedora 38 : nats-server (2023-c33188f575)
The remote Fedora 38 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2023-c33188f575 advisory. Without any authorization rules in the nats-server, users can connect without authentication. Before nats-server 2.2.0, all authentication and authorization...
Authentication Bypass
github.com/nats-io/nats-server is vulnerable to Authentication Bypass. The vulnerability occurs when the only account added is the system account $SYS. In this scenario, the nats-server creates an implicit user in $G and designates it as the noauthuser account. This effectively enables the same...
Fedora: Security Advisory for nats-server (FEDORA-2023-f122ea1b3e)
The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
[SECURITY] Fedora 38 Update: nats-server-2.10.1-4.fc38
A High Performance NATS Server written in Go and hosted by the Cloud Native Computing Foundation CNCF...
Path Traversal
NATS nats-server is vulnerable to Path Traversal. The vulnerability is caused by a missing validation check while constructing filenames for account synchronization, which happens in the system account, allowing arbitrary file write as the user running NATS by anyone who can publish arbitrary...
GHSA-VPJC-4JCV-JC29 NATS nats-server allows directory traversal via unintended path to a management action
NATS nats-server 2.2.0 through 2.7.4 allows directory traversal because of an unintended path to a management action from a management account...
NATS nats-server allows directory traversal via unintended path to a management action
NATS nats-server 2.2.0 through 2.7.4 allows directory traversal because of an unintended path to a management action from a management account...
