Nats Server
By the Year
In 2023 there have been 1 vulnerability in Nats Server with an average score of 7.5 out of ten. Last year Nats Server had 2 security vulnerabilities published. Right now, Nats Server is on track to have less security vulnerabilities in 2023 than it did last year. Last year, the average CVE base score was greater by 0.15
| Year | Vulnerabilities | Average Score |
|---|---|---|
| 2023 | 1 | 7.50 |
| 2022 | 2 | 7.65 |
| 2021 | 2 | 7.50 |
| 2020 | 0 | 0.00 |
| 2019 | 1 | 7.50 |
| 2018 | 0 | 0.00 |
It may take a day or so for new Nats Server vulnerabilities to show up in the stats or in the list of recent security vulnerabilties. Additionally vulnerabilities may be tagged under a different product or component name.
Recent Nats Server Security Vulnerabilities
NATS.io is a high performance open source pub-sub distributed communication technology
CVE-2023-46129
7.5 - High
- October 31, 2023
NATS.io is a high performance open source pub-sub distributed communication technology, built for the cloud, on-premise, IoT, and edge computing. The cryptographic key handling library, nkeys, recently gained support for encryption, not just for signing/authentication. This is used in nats-server 2.10 (Sep 2023) and newer for authentication callouts. In nkeys versions 0.4.0 through 0.4.5, corresponding with NATS server versions 2.10.0 through 2.10.3, the nkeys library's `xkeys` encryption handling logic mistakenly passed an array by value into an internal function, where the function mutated that buffer to populate the encryption key to use. As a result, all encryption was actually to an all-zeros key. This affects encryption only, not signing. FIXME: FILL IN IMPACT ON NATS-SERVER AUTH CALLOUT SECURITY. nkeys Go library 0.4.6, corresponding with NATS Server 2.10.4, has a patch for this issue. No known workarounds are available. For any application handling auth callouts in Go, if using the nkeys library, update the dependency, recompile and deploy that in lockstep.
Use of Hard-coded Cryptographic Key
NATS nats-server before 2.7.4 allows Directory Traversal (with write access) via an element in a ZIP archive for JetStream streams
CVE-2022-26652
6.5 - Medium
- March 10, 2022
NATS nats-server before 2.7.4 allows Directory Traversal (with write access) via an element in a ZIP archive for JetStream streams. nats-streaming-server before 0.24.3 is also affected.
Directory traversal
NATS nats-server before 2.7.2 has Incorrect Access Control
CVE-2022-24450
8.8 - High
- February 08, 2022
NATS nats-server before 2.7.2 has Incorrect Access Control. Any authenticated user can obtain the privileges of the System account by misusing the "dynamically provisioned sandbox accounts" feature.
AuthZ
NATS Server 2.x before 2.2.0 and JWT library before 2.0.1 have Incorrect Access Control
CVE-2021-3127
7.5 - High
- March 16, 2021
NATS Server 2.x before 2.2.0 and JWT library before 2.0.1 have Incorrect Access Control because Import Token bindings are mishandled.
Improper Handling of Exceptional Conditions
This affects all versions of package github.com/nats-io/nats-server/server
CVE-2020-28466
7.5 - High
- March 07, 2021
This affects all versions of package github.com/nats-io/nats-server/server. Untrusted accounts are able to crash the server using configs that represent a service export/import cycles. Disclaimer from the maintainers: Running a NATS service which is exposed to untrusted users presents a heightened risk. Any remote execution flaw or equivalent seriousness, or denial-of-service by unauthenticated users, will lead to prompt releases by the NATS maintainers. Fixes for denial of service issues with no threat of remote execution, when limited to account holders, are likely to just be committed to the main development branch with no special attention. Those who are running such services are encouraged to build regularly from git.
An integer overflow in NATS Server before 2.0.2 allows a remote attacker to crash the server by sending a crafted request
CVE-2019-13126
7.5 - High
- July 29, 2019
An integer overflow in NATS Server before 2.0.2 allows a remote attacker to crash the server by sending a crafted request. If authentication is enabled, then the remote attacker must have first authenticated.
Integer Overflow or Wraparound
Stay on top of Security Vulnerabilities
Want an email whenever new vulnerabilities are published for Nats Server or by Nats? Click the Watch button to subscribe.
