1025 matches found
NATS server TLS missing ciphersuite settings when CLI flags used
This advisory is canonically Problem Description The NATS server by default uses a restricted set of modern ciphersuites for TLS. This selection can be overridden through configuration. The defaults include just RSA and ECDSA with either AES/GCM with a SHA2 digest or ChaCha20/Poly1305. The...
GHSA-JJ54-5Q2M-Q7PJ NATS server TLS missing ciphersuite settings when CLI flags used
This advisory is canonically Problem Description The NATS server by default uses a restricted set of modern ciphersuites for TLS. This selection can be overridden through configuration. The defaults include just RSA and ECDSA with either AES/GCM with a SHA2 digest or ChaCha20/Poly1305. The...
PT-2024-10931 · Unknown · Nats Server
Name of the Vulnerable Software and Affected Versions: nats-server versions prior to 2.2.3 Description: The issue concerns cryptographic problems in the nats-server, where the use of CLI flags to set TLS parameters overrides the default restricted ciphersuite settings, potentially allowing client...
CVE-2024-24788 vulnerabilities
Vulnerabilities for packages: gostatsd, tekton-chains-fips, caddy-fips, logstash-exporter-fips, prometheus-mongodb-exporter-fips, kubernetes-dashboard, guac, mc, chartmuseum, dask-gateway, paranoia, cadvisor, dockerize, prometheus-postgres-exporter, prometheus-stackdriver-exporter, sonobuoy,...
Fedora 40 : golang-github-nats-io / golang-github-nats-io-jwt-2 / etc (2023-5f984129b2)
The remote Fedora 40 host has packages installed that are affected by multiple vulnerabilities as referenced in the FEDORA-2023-5f984129b2 advisory. Updated NATS stack for CVE-2023-39325 and CVE-2023-46129 Tenable has extracted the preceding description block directly from the Fedora security...
Fedora 40 : golang-github-nats-io / golang-github-protobuf / nats-server (2023-5f904f4dd4)
The remote Fedora 40 host has packages installed that are affected by multiple vulnerabilities as referenced in the FEDORA-2023-5f904f4dd4 advisory. Contains updates to address CVE-2022-28357,41717 Tenable has extracted the preceding description block directly from the Fedora security advisory...
BIT-NATS-2020-28466 Denial of Service (DoS)
This affects all versions of package github.com/nats-io/nats-server/server. Untrusted accounts are able to crash the server using configs that represent a service export/import cycles. Disclaimer from the maintainers: Running a NATS service which is exposed to untrusted users presents a heightene...
BIT-NATS-2021-3127
NATS Server 2.x before 2.2.0 and JWT library before 2.0.1 have Incorrect Access Control because Import Token bindings are mishandled...
BIT-NATS-2022-24450
NATS nats-server before 2.7.2 has Incorrect Access Control. Any authenticated user can obtain the privileges of the System account by misusing the "dynamically provisioned sandbox accounts" feature...
BIT-NATS-2022-26652
NATS nats-server before 2.7.4 allows Directory Traversal with write access via an element in a ZIP archive for JetStream streams. nats-streaming-server before 0.24.3 is also affected...
BIT-NATS-2023-46129 xkeys Seal encryption used fixed key for all encryption
NATS.io is a high performance open source pub-sub distributed communication technology, built for the cloud, on-premise, IoT, and edge computing. The cryptographic key handling library, nkeys, recently gained support for encryption, not just for signing/authentication. This is used in nats-server...
CVE-2023-45289 vulnerabilities
Vulnerabilities for packages: supercronic, dagger, hubble-ui, cert-exporter, k8sgpt, gops, nodetaint, wazero, docker-credential-acr-env, esbuild, nri-mysql, go-md2man, cadvisor, dynamic-localpv-provisioner, metrics-server, task, argo-workflows, nri-mongodb, ctop, http-echo, direnv, thanos-operato...
[SECURITY] Fedora 39 Update: nats-server-2.10.5-1.fc39
A High Performance NATS Server written in Go and hosted by the Cloud Native Computing Foundation CNCF...
[SECURITY] Fedora 39 Update: golang-github-nats-io-jwt-2-2.5.3-1.fc39
JWT tokens signed using NKeys for Ed25519 for the NATS ecosystem...
[SECURITY] Fedora 39 Update: golang-github-nats-io-nkeys-0.4.6-1.fc39
A public-key signature system based on Ed25519 for the NATS ecosystem...
[SECURITY] Fedora 39 Update: golang-github-nats-io-1.31.0-1.fc39
Golang client for NATS, the cloud native messaging system...
[SECURITY] Fedora 39 Update: golang-github-nats-io-streaming-server-0.25.6-1.fc39
NATS Streaming is an extremely performant, lightweight reliable streaming platform built on NATS...
[SECURITY] Fedora 38 Update: nats-server-2.10.5-1.fc38
A High Performance NATS Server written in Go and hosted by the Cloud Native Computing Foundation CNCF...