oss-security - Re: NATS: 2023-01: Adding accounts for just the system account adds auth bypass

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <ZT0t-5HDT_cAcgC2@eldamar.lan>
Date: Sat, 28 Oct 2023 17:51:23 +0200
From: Salvatore Bonaccorso <carnil@...ian.org>
To: oss-security@...ts.openwall.com
Cc: pdp@...s.io
Subject: Re: NATS: 2023-01: Adding accounts for just the
 system account adds auth bypass

Hi,

On Thu, Oct 12, 2023 at 10:39:53PM -0400, Phil Pennock wrote:
> [ CVE has been requested, still waiting for assignment, so we're just
>   inventing our own in-house numbering for advisories; we'll make sure
>   this one continues to work after the CVE is issued ]
> 
> NATS-advisory-ID: 2023-01
> CVE: pending
> Date: 2023-10-12
> Fixed in: 2.9.23, 2.10.2

While I see the later NATS-advisory-ID 2023-02 has a CVE assigned, for
the 2023-01 was above with CVE pending. has one been assigned in
meanwhile?

Regards,
Salvatore

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.