CVE-2023-46129

NATS.io is a high performance open source pub-sub distributed communication technology, built for the cloud, on-premise, IoT, and edge computing. The cryptographic key handling library, nkeys, recently gained support for encryption, not just for signing/authentication. This is used in nats-server 2.10 (Sep 2023) and newer for authentication callouts. In nkeys versions 0.4.0 through 0.4.5, corresponding with NATS server versions 2.10.0 through 2.10.3, the nkeys library's `xkeys` encryption handling logic mistakenly passed an array by value into an internal function, where the function mutated that buffer to populate the encryption key to use. As a result, all encryption was actually to an all-zeros key. This affects encryption only, not signing. FIXME: FILL IN IMPACT ON NATS-SERVER AUTH CALLOUT SECURITY. nkeys Go library 0.4.6, corresponding with NATS Server 2.10.4, has a patch for this issue. No known workarounds are available. For any application handling auth callouts in Go, if using the nkeys library, update the dependency, recompile and deploy that in lockstep.
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:nats:nats_server:*:*:*:*:*:*:*:*
cpe:2.3:a:nats:nkeys:*:*:*:*:*:*:*:*

History

29 Nov 2023, 03:15

Type Values Removed Values Added
References
  • () https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ULQQONMSCQSH5Z5OWFFQHCGEZ3NL4DRJ/ -
  • () https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/R3UETKPUB3V5JS5TLZOF3SMTGT5K5APS/ -

08 Nov 2023, 19:01

Type Values Removed Values Added
References (MISC) http://www.openwall.com/lists/oss-security/2023/10/31/1 - (MISC) http://www.openwall.com/lists/oss-security/2023/10/31/1 - Mailing List, Third Party Advisory
References (MISC) https://github.com/nats-io/nkeys/security/advisories/GHSA-mr45-rx8q-wcm9 - (MISC) https://github.com/nats-io/nkeys/security/advisories/GHSA-mr45-rx8q-wcm9 - Vendor Advisory
First Time Nats
Nats nats Server
Nats nkeys
CVSS v2 : unknown
v3 : unknown
v2 : unknown
v3 : 7.5
CPE cpe:2.3:a:nats:nats_server:*:*:*:*:*:*:*:*
cpe:2.3:a:nats:nkeys:*:*:*:*:*:*:*:*

31 Oct 2023, 18:15

Type Values Removed Values Added
References
  • (MISC) http://www.openwall.com/lists/oss-security/2023/10/31/1 -

31 Oct 2023, 00:15

Type Values Removed Values Added
New CVE

Information

Published : 2023-10-31 00:15

Updated : 2024-02-28 20:33


NVD link : CVE-2023-46129

Mitre link : CVE-2023-46129

CVE.ORG link : CVE-2023-46129


JSON object : View

Products Affected

nats

  • nkeys
  • nats_server
CWE
CWE-321

Use of Hard-coded Cryptographic Key

CWE-325

Missing Cryptographic Step