Nil dereference in NATS JWT, DoS of nats-server

Problem Description The NATS account system has an Operator trusted by the servers, which signs Accounts, and each Account can then create and sign Users within their account. The Operator should be able to safely issue Accounts to other entities which it does not fully trust. A malicious Account...

PT-2020-16435

Name of the Vulnerable Software and Affected Versions NATS Server versions 2 prior to 2.1.9 JWT library versions prior to 1.1.0 Description A malicious account can create and sign a User JWT with a state not created by the normal tooling, such that decoding by the NATS JWT library would attempt a...