PT-2023-29861 · Unknown+1 · Nats Server+1

Tinou98 · Publicado 2023-10-30 · Atualizado 2024-03-06 · CVE-2023-46129

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions nkeys versions 0.4.0 through 0.4.5 NATS Server versions 2.10.0 through 2.10.3

Description NATS.io is a high performance open source pub-sub distributed communication technology. The cryptographic key handling library, nkeys, recently gained support for encryption. In nkeys versions 0.4.0 through 0.4.5, the xkeys encryption handling logic mistakenly passed an array by value into an internal function, where the function mutated that buffer to populate the encryption key to use. As a result, all encryption was actually to an all-zeros key. This affects encryption only, not signing.

Recommendations For nkeys versions 0.4.0 through 0.4.5, update the dependency to version 0.4.6 or later, recompile, and deploy in lockstep. For NATS Server versions 2.10.0 through 2.10.3, upgrade to version 2.10.4 or later.

Exploit

Correção

Enumeração de Fraquezas

CWE-321

CWE-325

Identificadores relacionados

AZL-31792

AZL-35298

BIT-NATS-2023-46129

CVE-2023-46129

GHSA-MR45-RX8Q-WCM9

GO-2023-2163

Produtos afetados

Nats Server

Nkeys

Referências · 22

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/46xxx/CVE-2023-46129.json · Exploit
• https://github.com/nats-io/nkeys/security/advisories/GHSA-mr45-rx8q-wcm9 · Aviso do Fabricante
• https://github.com/nats-io/nkeys · Nota
• https://github.com/nats-io/nkeys/commit/58fb9d69f42ea73fffad1d14e5914dc666f3daa1 · Nota
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/ULQQONMSCQSH5Z5OWFFQHCGEZ3NL4DRJ · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2023-46129 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-mr45-rx8q-wcm9 · Aviso do Fabricante
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/R3UETKPUB3V5JS5TLZOF3SMTGT5K5APS · Aviso do Fabricante
• https://osv.dev/vulnerability/BIT-nats-2023-46129 · Aviso do Fabricante
• https://osv.dev/vulnerability/UBUNTU-CVE-2023-46129 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-46129 · Nota de Segurança
• https://osv.dev/vulnerability/DEBIAN-CVE-2023-46129 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2023-46129 · Aviso do Fabricante
• https://osv.dev/vulnerability/AZL-31792 · Aviso do Fabricante
• http://openwall.com/lists/oss-security/2023/10/31/1 · Nota