oss-security - [CVE-2020-28466][CVE-2021-3127] NATS.io vulnerabilities

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <YFAXlFS+y63uKlto@fullerene.field.pennock-tech.net>
Date: Mon, 15 Mar 2021 22:27:32 -0400
From: Phil Pennock <oss-security-phil@...dhuis.org>
To: oss-security@...ts.openwall.com
Cc: Phil Pennock <pdp@...adia.com>
Subject: [CVE-2020-28466][CVE-2021-3127] NATS.io vulnerabilities

[moderators: my apologies for the initial unsigned message, please
 discard that one and permit this one]

Folks,

Two new CVEs for the NATS project for issues fixed with the
2.2.0 release.  The full text of the advisories should be attached.
These, and other advisories, can be found at
<https://advisories.nats.io/>.

 * CVE-2020-28466
   + import loops between accounts, expressed in the account JWT, could
     DoS the server
   + this was fixed in public git some time ago without initially
     thinking of the security impact, this was the first
     release since then
   + realistically, the current situation is that if you have untrusted
     third parties with control over their account JWTs, then while
     we'll hurry security releases for severe flaws (compromise,
     disclosure), for DoS protection folks need to follow closer to git
     mainline

 * CVE-2021-3127
   + this one is far more serious: information disclosure between
     accounts
   + something which should have been an error was a disregarded
     warning, letting people reuse binding tokens to bypass access
     controls on data exports from an account because the binding was
     not enforced
   + the bug is in the JWT library, the current NATS server has the fix
     in as as a dependency; the advisory includes a Python script which
     can be pointed at your account server's account pack URL, or a pack
     on local disk, to audit all the accounts to find instances of
     someone exploiting this

Regards,
-Phil Pennock

View attachment "CVE-2020-28466.txt" of type "text/plain" (1969 bytes)

View attachment "CVE-2021-3127.txt" of type "text/plain" (7627 bytes)

Download attachment "signature.asc" of type "application/pgp-signature" (229 bytes)

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.