oss-security - [CVE-2020-26521][CVE-2020-26892] NATS JWT vulnerabilities

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20201102173429.GA1527710@fullerene.field.pennock-tech.net>
Date: Mon, 2 Nov 2020 12:34:29 -0500
From: Phil Pennock <oss-security-phil@...dhuis.org>
To: oss-security@...ts.openwall.com
Cc: Phil Pennock <pdp@...adia.com>
Subject: [CVE-2020-26521][CVE-2020-26892] NATS JWT vulnerabilities

Folks,

The NATS project has a new advisories website:
  <https://advisories.nats.io/>

We also have two new CVEs; both relate to our JWT handling and both
affect the NATS server:

* CVE-2020-26521
  + Nil deref in JWT library, causing Go panic
  + NATS server upgrade required to avoid Denial-of-Service
  + 2020-11-02
* CVE-2020-26892
  + Incorrect credential expiration handling via JWT library
  + API fixes needed by library users
  + NATS server upgrade required for expiration to work
  + 2020-11-02

The text of our advisories should be attached.

We have just released NATS server 2.1.9 which includes the fixes for
both these issues.

Regards,
-Phil Pennock

View attachment "CVE-2020-26521.txt" of type "text/plain" (1525 bytes)

View attachment "CVE-2020-26892.txt" of type "text/plain" (1633 bytes)

Download attachment "signature.asc" of type "application/pgp-signature" (229 bytes)

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.