UBUNTU-CVE-2022-29946

NATS.io NATS Server before 2.8.2 and Streaming Server before 0.24.6 could allow a remote attacker to bypass security restrictions, caused by the failure to enforce negative user permissions in one scenario. By using a queue subscription on the wildcard, an attacker could exploit this vulnerabilit...

PT-2024-11549 · Unknown · Nats Server +1

Name of the Vulnerable Software and Affected Versions: NATS Server versions prior to 2.8.2 NATS Streaming Server versions prior to 0.24.6 Description: The issue is caused by the failure to enforce negative user permissions in one scenario, allowing a remote attacker to bypass security restriction...

NATS Server Security Vulnerability

NATS Server is an open source messaging system. The system is primarily used for cloud-native applications, IoT messaging, and microservices architectures. NATS.io A security vulnerability exists in NATS Server versions prior to 2.8.2 and Streaming Server versions prior to 0.24.6, which stems fro...

CVE-2022-29946

NATS.io NATS Server before 2.8.2 and Streaming Server before 0.24.6 could allow a remote attacker to bypass security restrictions, caused by the failure to enforce negative user permissions in one scenario. By using a queue subscription on the wildcard, an attacker could exploit this vulnerabilit...

CBL Mariner 2.0 Security Update: telegraf (CVE-2023-47090)

The version of telegraf installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2023-47090 advisory. - NATS nats-server before 2.9.23 and 2.10.x before 2.10.2 has an authentication bypass. An implicit $G user ...

CVE-2024-24789 vulnerabilities

Vulnerabilities for packages: gobump, newrelic-fluent-bit-output, ctop, vt-cli, dex, supercronic, velero-plugin-for-aws-fips, kubernetes-dashboard-fips, kiam, dataplaneapi, cni-plugins, falcosidekick, metallb, cert-manager-webhook-pdns, actions-runner-controller, trivy-fips, fluent-operator,...

GO-2024-2850 NATS server TLS missing ciphersuite settings when CLI flags used in github.com/nats-io/nats-server

NATS server TLS missing ciphersuite settings when CLI flags used in github.com/nats-io/nats-server...

Improper TLS Ciphers Configuration

github.com/nats-io/nats-server/ is vulnerable to Improper TLS Ciphers Configuration. The vulnerability is due to the loss of restricted ciphersuite settings when using CLI options to set a key/cert for TLS, enabling all ciphersuites supported by Go by default...

GHSA-JJ54-5Q2M-Q7PJ NATS server TLS missing ciphersuite settings when CLI flags used

This advisory is canonically Problem Description The NATS server by default uses a restricted set of modern ciphersuites for TLS. This selection can be overridden through configuration. The defaults include just RSA and ECDSA with either AES/GCM with a SHA2 digest or ChaCha20/Poly1305. The...

NATS server TLS missing ciphersuite settings when CLI flags used

This advisory is canonically Problem Description The NATS server by default uses a restricted set of modern ciphersuites for TLS. This selection can be overridden through configuration. The defaults include just RSA and ECDSA with either AES/GCM with a SHA2 digest or ChaCha20/Poly1305. The...

PT-2024-10931 · Unknown · Nats Server

Name of the Vulnerable Software and Affected Versions: nats-server versions prior to 2.2.3 Description: The issue concerns cryptographic problems in the nats-server, where the use of CLI flags to set TLS parameters overrides the default restricted ciphersuite settings, potentially allowing client...

CVE-2024-24788 vulnerabilities

Vulnerabilities for packages: ghaudit, wireguard-go, flux-kustomize-controller, gosu, aws-efs-csi-driver, dgraph, dex-k8s-authenticator, gobump, k9s, kubernetes-csi-livenessprobe-fips, render-template, cilium-fips, gops, timestamp-authority-fips, docker-compose, cert-manager-webhook-pdns-fips,...

Fedora 40 : golang-github-nats-io / golang-github-nats-io-jwt-2 / etc (2023-5f984129b2)

The remote Fedora 40 host has packages installed that are affected by multiple vulnerabilities as referenced in the FEDORA-2023-5f984129b2 advisory. Updated NATS stack for CVE-2023-39325 and CVE-2023-46129 Tenable has extracted the preceding description block directly from the Fedora security...

Fedora 40 : golang-github-nats-io / golang-github-protobuf / nats-server (2023-5f904f4dd4)

The remote Fedora 40 host has packages installed that are affected by multiple vulnerabilities as referenced in the FEDORA-2023-5f904f4dd4 advisory. Contains updates to address CVE-2022-28357,41717 Tenable has extracted the preceding description block directly from the Fedora security advisory...

BIT-NATS-2020-28466 Denial of Service (DoS)

This affects all versions of package github.com/nats-io/nats-server/server. Untrusted accounts are able to crash the server using configs that represent a service export/import cycles. Disclaimer from the maintainers: Running a NATS service which is exposed to untrusted users presents a heightene...

BIT-NATS-2021-3127

NATS Server 2.x before 2.2.0 and JWT library before 2.0.1 have Incorrect Access Control because Import Token bindings are mishandled...

BIT-NATS-2022-24450

NATS nats-server before 2.7.2 has Incorrect Access Control. Any authenticated user can obtain the privileges of the System account by misusing the "dynamically provisioned sandbox accounts" feature...

BIT-NATS-2022-26652

NATS nats-server before 2.7.4 allows Directory Traversal with write access via an element in a ZIP archive for JetStream streams. nats-streaming-server before 0.24.3 is also affected...

BIT-NATS-2023-46129 xkeys Seal encryption used fixed key for all encryption

NATS.io is a high performance open source pub-sub distributed communication technology, built for the cloud, on-premise, IoT, and edge computing. The cryptographic key handling library, nkeys, recently gained support for encryption, not just for signing/authentication. This is used in nats-server...

CVE-2023-45289 vulnerabilities

Vulnerabilities for packages: prometheus-adapter, dask-gateway, buildkitd, eksctl, kube-bench, nri-apache, prometheus-alertmanager, pulumi-kubernetes-operator, kubernetes-dashboard, kyverno-policy-reporter, supercronic, yam, temporal, pulumi-language-yaml, docker-credential-acr-env, kubewatch,...