PT-2020-16534 · Jwt+1 · Jwt Library+2

Phil Pennock · Published 2020-11-06 · Updated 2022-07-15 · CVE-2020-26892

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions NATS nats-server versions 2.0.0 through 2.1.8 JWT library versions prior to 1.1.0

Description The issue is related to Incorrect Access Control in the JWT library used by NATS nats-server, specifically in how expired credentials are handled. The IsRevoked and Export.IsRevoked functions improperly validate expired credentials using the current system time rather than the issue time of the JWT. This results in time-based credential expiry not working. A new IsClaimRevoked method has been introduced with correct handling, and the nats-server has been updated to use this method. The old IsRevoked method now always returns true, and other client code will have to be updated to avoid calling it.

Recommendations For NATS nats-server versions 2.0.0 through 2.1.8, upgrade to version 2.1.9 or later. For JWT library versions prior to 1.1.0, upgrade the JWT dependency to version 1.1.0 or later. As a temporary workaround, consider having credentials that only expire after fixes can be deployed. Avoid using the IsRevoked method in the affected JWT library until the issue is resolved.

Fix

Improper Access Control

Using Hardcoded Credentials

Weakness Enumeration

CWE-284

CWE-798

Related Identifiers

CVE-2020-26892

GHSA-2C64-VJ8G-VWRQ

GHSA-4W5X-X539-PPF5

GO-2022-0380

Affected Products

Jwt Library

Nats

Nats Server

References · 23

• https://github.com/nats-io/nats-server/commits/master · Patch
• https://cve.org/CVERecord?id=CVE-2020-26892 · Security Note
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VT67XCLIIBYRT762SVFBYFFTQFVSM3SI · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-26892 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-4w5x-x539-ppf5 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-26892 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2020-26892 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-26892 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2020-26892 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/VT67XCLIIBYRT762SVFBYFFTQFVSM3SI · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-2c64-vj8g-vwrq · Vendor Advisory
• https://osv.dev/vulnerability/GO-2022-0380 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2020-26892 · Vendor Advisory
• https://github.com/nats-io/nats-server · Note
• https://github.com/nats-io/nats-server/security/advisories/GHSA-2c64-vj8g-vwrq · Note