github.com/nats-io/nats-streaming-server

3 results · Feed

• Medium 6.3
  CVE-2022-29946

  NATS Server and Streaming Server fails to enforce negative user permissions, may allow denied subjects

  NATS.io NATS Server before 2.8.2 and Streaming Server before 0.24.6 could allow a remote attacker to bypass security restrictions, caused by the failure to enforce negative user permissions in one scenario. By using a queue subscription on the wildcard, an at…

  nats-server github.com/nats-io/nats-server/v2 github.com/nats-io/nats-server github.com/nats-io/nats-streaming-server Debian Go
  Jul 11, 2024
• Medium 6.5
  CVE-2022-26652

  Arbitrary file write in nats-server

  NATS nats-server before 2.7.4 allows Directory Traversal (with write access) via an element in a ZIP archive for JetStream streams. nats-streaming-server before 0.24.3 is also affected.

  github.com/nats-io/nats-server/v2 github.com/nats-io/nats-server github.com/nats-io/nats-streaming-server Go
  Mar 10, 2022
• High 8.8
  CVE-2022-24450

  Incorrect Authorization in NATS nats-server

  NATS nats-server before 2.7.2 has Incorrect Access Control. Any authenticated user can obtain the privileges of the System account by misusing the "dynamically provisioned sandbox accounts" feature.

  github.com/nats-io/nats-server/v2 github.com/nats-io/nats-server github.com/nats-io/nats-streaming-server Go
  Feb 8, 2022