PT-2024-10931 · Unknown · Nats Server

Published 2024-05-14 · Updated 2024-07-08 · CVE-2021-32026

Positive Technologies (AI Summary)

Name of the Vulnerable Software and Affected Versions nats-server versions prior to 2.2.3

Description The issue concerns cryptographic problems in the nats-server, where the use of CLI flags to set TLS parameters overrides the default restricted ciphersuite settings, potentially allowing clients to negotiate unexpected TLS ciphersuites. This could compromise security, particularly for local attackers. The estimated number of potentially affected devices is not specified.

Recommendations For versions prior to 2.2.3, upgrade the NATS server to remediate the issue. As a temporary workaround, consider using a configuration file to set the TLS parameters instead of command-line options.

Related Identifiers

CVE-2021-32026

GHSA-JJ54-5Q2M-Q7PJ

GO-2024-2850

Affected Products

Nats Server

References · 8

• https://osv.dev/vulnerability/GO-2024-2850 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-jj54-5q2m-q7pj · Vendor Advisory
• https://github.com/nats-io/nats-server · Note
• https://github.com/nats-io/nats-server/commit/ffccc2e1bd7aa2466bd9e631e976bfd7ca46f225 · Note
• https://github.com/nats-io/nats-server/security/advisories/GHSA-jj54-5q2m-q7pj · Note
• https://twitter.com/oktsec/status/1810390791577084346 · Twitter Post
• https://advisories.nats.io/CVE/CVE-2021-32026.txt · Note
• https://advisories.nats.io · Note