PT-2023-29861 · Unknown+1 · Nats Server+1

Tinou98 · Published 2023-10-30 · Updated 2024-03-06 · CVE-2023-46129

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions nkeys versions 0.4.0 through 0.4.5 NATS Server versions 2.10.0 through 2.10.3

Description NATS.io is a high performance open source pub-sub distributed communication technology. The cryptographic key handling library, nkeys, recently gained support for encryption. In nkeys versions 0.4.0 through 0.4.5, the xkeys encryption handling logic mistakenly passed an array by value into an internal function, where the function mutated that buffer to populate the encryption key to use. As a result, all encryption was actually to an all-zeros key. This affects encryption only, not signing.

Recommendations For nkeys versions 0.4.0 through 0.4.5, update the dependency to version 0.4.6 or later, recompile, and deploy in lockstep. For NATS Server versions 2.10.0 through 2.10.3, upgrade to version 2.10.4 or later.

Exploit

Fix

Weakness Enumeration

CWE-321

CWE-325

Related Identifiers

AZL-31792

AZL-35298

BIT-NATS-2023-46129

CVE-2023-46129

GHSA-MR45-RX8Q-WCM9

GO-2023-2163

Affected Products

Nats Server

Nkeys

References · 22

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/46xxx/CVE-2023-46129.json · Exploit
• https://github.com/nats-io/nkeys/security/advisories/GHSA-mr45-rx8q-wcm9 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/ULQQONMSCQSH5Z5OWFFQHCGEZ3NL4DRJ · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-46129 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-mr45-rx8q-wcm9 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/R3UETKPUB3V5JS5TLZOF3SMTGT5K5APS · Vendor Advisory
• https://osv.dev/vulnerability/BIT-nats-2023-46129 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2023-46129 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-46129 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2023-46129 · Vendor Advisory
• https://ubuntu.com/security/CVE-2023-46129 · Vendor Advisory
• https://osv.dev/vulnerability/AZL-31792 · Vendor Advisory
• https://osv.dev/vulnerability/AZL-35298 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2023-46129 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2023-2163 · Vendor Advisory