Skip to content
OpenAdvisories

Description

NATS.io is a high performance open source pub-sub distributed communication technology, built for the cloud, on-premise, IoT, and edge computing. The cryptographic key handling library, nkeys, recently gained support for encryption, not just for signing/authentication. This is used in nats-server 2.10 (Sep 2023) and newer for authentication callouts. In nkeys versions 0.4.0 through 0.4.5, corresponding with NATS server versions 2.10.0 through 2.10.3, the nkeys library's `xkeys` encryption handling logic mistakenly passed an array by value into an internal function, where the function mutated that buffer to populate the encryption key to use. As a result, all encryption was actually to an all-zeros key. This affects encryption only, not signing.
FIXME: FILL IN IMPACT ON NATS-SERVER AUTH CALLOUT SECURITY. nkeys Go library 0.4.6, corresponding with NATS Server 2.10.4, has a patch for this issue. No known workarounds are available. For any application handling auth callouts in Go, if using the nkeys library, update the dependency, recompile and deploy that in lockstep.

Affected products

VendorProductAffectedFixed
nats-io nkeys >= 2.10.0, < 2.10.4, >= 0.4.0, < 0.4.6 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

ReleasePackageFixed inAdvisory
Debian 14 golang-github-nats-io-nkeys 0.4.6-1 —
Debian 14 nats-server 2.10.4-1 —
Debian 13 golang-github-nats-io-nkeys 0.4.6-1 —
Debian 13 nats-server 2.10.4-1 —
ReleasePackageFixed inAdvisory
Ubuntu 22.04 LTS golang-github-nats-io-nkeys No fix yet —
Ubuntu 20.04 LTS golang-github-nats-io-nkeys No fix yet —
ReleasePackageFixed inAdvisory
Alpine v3.24 nats-server 2.10.4-r0 —
Alpine v3.23 nats-server 2.10.4-r0 —
Alpine v3.22 nats-server 2.10.4-r0 —
Alpine v3.21 nats-server 2.10.4-r0 —
Alpine v3.20 nats-server 2.10.4-r0 —
Show 1 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Alpine v3.19 nats-server 2.10.4-r0 —

Azure Linux

ReleasePackageFixed inAdvisory
Azure Linux 3 telegraf 1.29.4-1 —
Azure Linux 2 (CBL-Mariner) telegraf 1.27.4-1 —

Wolfi

ReleasePackageFixed inAdvisory
Wolfi rolling k3s 1.28.3-r1 —
Wolfi rolling minio 0.20231101.183725-r0 —
Wolfi rolling nats 0.1.1-r5 —
Wolfi rolling nats-server 2.10.4-r0 —

Affected packages

EcosystemPackageAffectedFixedRecord
Go github.com/nats-io/nats-server/v2 >= 2.10.0, < 2.10.4 2.10.4 GHSA-mr45-rx8q-wcm9
Go github.com/nats-io/nkeys >= 0.4.0, < 0.4.6 0.4.6 GHSA-mr45-rx8q-wcm9

Advisories 1

References