PT-2020-16435 · Nats · Nats Server+1

Phil Pennock · Published 2020-11-06 · Updated 2022-07-01 · CVE-2020-26521

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions NATS Server versions 2 prior to 2.1.9 JWT library versions prior to 1.1.0

Description A malicious account can create and sign a User JWT with a state not created by the normal tooling, such that decoding by the NATS JWT library would attempt a nil dereference, aborting execution. This can cause a Denial of Service due to process termination in the NATS Server. The issue is related to the NATS account system, where an Operator trusted by the servers signs Accounts, and each Account can then create and sign Users within their account.

Recommendations Upgrade the NATS server to version 2.1.9 or later if using NATS Accounts. Upgrade the JWT dependency in any application using it to version 1.1.0 or later. If your NATS servers do not trust any accounts which are managed by untrusted entities, then malformed User credentials are unlikely to be encountered, and you may not need to take immediate action. However, upgrading is still recommended to prevent potential issues.

Fix

NULL Pointer Dereference

Weakness Enumeration

CWE-476

Related Identifiers

CVE-2020-26521

GHSA-H2FG-54X9-5QHQ

GHSA-HMM9-R2M2-QG9W

GO-2022-0402

Affected Products

Jwt Library

Nats Server

References · 23

• https://github.com/nats-io/nats-server/commits/master · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2020-26521 · Security Note
• https://cve.org/CVERecord?id=CVE-2020-26521 · Security Note
• https://ubuntu.com/security/CVE-2020-26521 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VT67XCLIIBYRT762SVFBYFFTQFVSM3SI · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2020-26521 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2022-0402 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2020-26521 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-26521 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2020-26521 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/VT67XCLIIBYRT762SVFBYFFTQFVSM3SI · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-h2fg-54x9-5qhq · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-hmm9-r2m2-qg9w · Vendor Advisory
• https://github.com/nats-io/nats-server · Note
• https://github.com/nats-io/nats-server/commit/9ff8bcde2e46009e98bd9e88f598af355f62c168 · Note