Description
NATS.io is a high performance open source pub-sub distributed communication technology, built for the cloud, on-premise, IoT, and edge computing. The cryptographic key handling library, nkeys, recently gained support for encryption, not just for signing/authentication. This is used in nats-server 2.10 (Sep 2023) and newer for authentication callouts. In nkeys versions 0.4.0 through 0.4.5, corresponding with NATS server versions 2.10.0 through 2.10.3, the nkeys library's `xkeys` encryption handling logic mistakenly passed an array by value into an internal function, where the function mutated that buffer to populate the encryption key to use. As a result, all encryption was actually to an all-zeros key. This affects encryption only, not signing.
FIXME: FILL IN IMPACT ON NATS-SERVER AUTH CALLOUT SECURITY. nkeys Go library 0.4.6, corresponding with NATS Server 2.10.4, has a patch for this issue. No known workarounds are available. For any application handling auth callouts in Go, if using the nkeys library, update the dependency, recompile and deploy that in lockstep.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| nats-io | nkeys | >= 2.10.0, < 2.10.4, >= 0.4.0, < 0.4.6 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | golang-github-nats-io-nkeys | 0.4.6-1 | — |
| Debian 14 | nats-server | 2.10.4-1 | — |
| Debian 13 | golang-github-nats-io-nkeys | 0.4.6-1 | — |
| Debian 13 | nats-server | 2.10.4-1 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 22.04 LTS | golang-github-nats-io-nkeys | No fix yet | — |
| Ubuntu 20.04 LTS | golang-github-nats-io-nkeys | No fix yet | — |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.24 | nats-server | 2.10.4-r0 | — |
| Alpine v3.23 | nats-server | 2.10.4-r0 | — |
| Alpine v3.22 | nats-server | 2.10.4-r0 | — |
| Alpine v3.21 | nats-server | 2.10.4-r0 | — |
| Alpine v3.20 | nats-server | 2.10.4-r0 | — |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.19 | nats-server | 2.10.4-r0 | — |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | telegraf | 1.29.4-1 | — |
| Azure Linux 2 (CBL-Mariner) | telegraf | 1.27.4-1 | — |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | k3s | 1.28.3-r1 | — |
| Wolfi rolling | minio | 0.20231101.183725-r0 | — |
| Wolfi rolling | nats | 0.1.1-r5 | — |
| Wolfi rolling | nats-server | 2.10.4-r0 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Go | github.com/nats-io/nats-server/v2 | >= 2.10.0, < 2.10.4 | 2.10.4 | GHSA-mr45-rx8q-wcm9 |
| Go | github.com/nats-io/nkeys | >= 0.4.0, < 0.4.6 | 0.4.6 | GHSA-mr45-rx8q-wcm9 |
Advisories 1
- WID-SEC-2023-3067 Red Hat OpenShift: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 13, 2024
References
- https://github.com/nats-io/nkeys/security/advisories/GHSA-mr45-rx8q-wcm9
- http://www.openwall.com/lists/oss-security/2023/10/31/1
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ULQQONMSCQSH5Z5OWFFQHCGEZ3NL4DRJ/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/R3UETKPUB3V5JS5TLZOF3SMTGT5K5APS/