938 matches found
CBL Mariner 2.0 Security Update: telegraf (CVE-2023-47090)
The version of telegraf installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2023-47090 advisory. - NATS nats-server before 2.9.23 and 2.10.x before 2.10.2 has an authentication bypass. An implicit $G user ...
CVE-2024-24789 vulnerabilities
Vulnerabilities for packages: tflint, azure-aad-pod-identity-mic, buildah, pulumi-language-dotnet, vcluster, trust-manager-fips, cadvisor-fips, wave, litestream, tkn-fips, tekton-chains, lazygit, nri-rabbitmq, vexctl, speedtest-go, hey, nerdctl, cue-fips, external-secrets-fips,...
GO-2024-2850 NATS server TLS missing ciphersuite settings when CLI flags used in github.com/nats-io/nats-server
NATS server TLS missing ciphersuite settings when CLI flags used in github.com/nats-io/nats-server...
Improper TLS Ciphers Configuration
github.com/nats-io/nats-server/ is vulnerable to Improper TLS Ciphers Configuration. The vulnerability is due to the loss of restricted ciphersuite settings when using CLI options to set a key/cert for TLS, enabling all ciphersuites supported by Go by default...
NATS server TLS missing ciphersuite settings when CLI flags used
This advisory is canonically Problem Description The NATS server by default uses a restricted set of modern ciphersuites for TLS. This selection can be overridden through configuration. The defaults include just RSA and ECDSA with either AES/GCM with a SHA2 digest or ChaCha20/Poly1305. The...
GHSA-JJ54-5Q2M-Q7PJ NATS server TLS missing ciphersuite settings when CLI flags used
This advisory is canonically Problem Description The NATS server by default uses a restricted set of modern ciphersuites for TLS. This selection can be overridden through configuration. The defaults include just RSA and ECDSA with either AES/GCM with a SHA2 digest or ChaCha20/Poly1305. The...
PT-2024-10931 · Unknown · Nats Server
Name of the Vulnerable Software and Affected Versions: nats-server versions prior to 2.2.3 Description: The issue concerns cryptographic problems in the nats-server, where the use of CLI flags to set TLS parameters overrides the default restricted ciphersuite settings, potentially allowing client...
CVE-2024-24788 vulnerabilities
Vulnerabilities for packages: azure-aad-pod-identity-mic, pulumi-language-dotnet, configmap-reload, boring-registry-fips, kubernetes-dashboard-metrics-scraper-fips, cue, docker-credential-acr-env, eksctl, karpenter-fips, trust-manager-fips, cadvisor-fips, gitness,...
Fedora 40 : golang-github-nats-io / golang-github-nats-io-jwt-2 / etc (2023-5f984129b2)
The remote Fedora 40 host has packages installed that are affected by multiple vulnerabilities as referenced in the FEDORA-2023-5f984129b2 advisory. Updated NATS stack for CVE-2023-39325 and CVE-2023-46129 Tenable has extracted the preceding description block directly from the Fedora security...
Fedora 40 : golang-github-nats-io / golang-github-protobuf / nats-server (2023-5f904f4dd4)
The remote Fedora 40 host has packages installed that are affected by multiple vulnerabilities as referenced in the FEDORA-2023-5f904f4dd4 advisory. Contains updates to address CVE-2022-28357,41717 Tenable has extracted the preceding description block directly from the Fedora security advisory...
BIT-NATS-2020-28466 Denial of Service (DoS)
This affects all versions of package github.com/nats-io/nats-server/server. Untrusted accounts are able to crash the server using configs that represent a service export/import cycles. Disclaimer from the maintainers: Running a NATS service which is exposed to untrusted users presents a heightene...
BIT-NATS-2021-3127
NATS Server 2.x before 2.2.0 and JWT library before 2.0.1 have Incorrect Access Control because Import Token bindings are mishandled...
BIT-NATS-2022-24450
NATS nats-server before 2.7.2 has Incorrect Access Control. Any authenticated user can obtain the privileges of the System account by misusing the "dynamically provisioned sandbox accounts" feature...
BIT-NATS-2022-26652
NATS nats-server before 2.7.4 allows Directory Traversal with write access via an element in a ZIP archive for JetStream streams. nats-streaming-server before 0.24.3 is also affected...
BIT-NATS-2023-46129 xkeys Seal encryption used fixed key for all encryption
NATS.io is a high performance open source pub-sub distributed communication technology, built for the cloud, on-premise, IoT, and edge computing. The cryptographic key handling library, nkeys, recently gained support for encryption, not just for signing/authentication. This is used in nats-server...
CVE-2023-45289 vulnerabilities
Vulnerabilities for packages: ferretdb, temporal-ui-server, flux, kube-state-metrics, esbuild, flux-image-reflector-controller, cfssl, hubble-ui, kubernetes-csi-livenessprobe, gke-gcloud-auth-plugin, oras, wazero, vite, cni-plugins, cluster-proportional-autoscaler, trillian, velero,...
[SECURITY] Fedora 39 Update: nats-server-2.10.5-1.fc39
A High Performance NATS Server written in Go and hosted by the Cloud Native Computing Foundation CNCF...
[SECURITY] Fedora 39 Update: golang-github-nats-io-jwt-2-2.5.3-1.fc39
JWT tokens signed using NKeys for Ed25519 for the NATS ecosystem...