CVE-2020-28466
published 2021-03-07CVE-2020-28466: This affects all versions of package github.com/nats-io/nats-server/server. Untrusted accounts are able to crash the server using configs that represent a…
PriorityP342high7.5CVSS 3.1
AVNACLPRNUINSUCNINAH
EPSS
3.66%
88.2th percentile
This affects all versions of package github.com/nats-io/nats-server/server. Untrusted accounts are able to crash the server using configs that represent a service export/import cycles. Disclaimer from the maintainers: Running a NATS service which is exposed to untrusted users presents a heightened risk. Any remote execution flaw or equivalent seriousness, or denial-of-service by unauthenticated users, will lead to prompt releases by the NATS maintainers. Fixes for denial of service issues with no threat of remote execution, when limited to account holders, are likely to just be committed to the main development branch with no special attention. Those who are running such services are encouraged to build regularly from git.
Affected
5 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | nats-server | — | — |
| github.com | nats-io_nats-server | >= 0 < 2.2.0 | 2.2.0 |
| github.com | nats-io_nats-server_server | < unspecified | unspecified |
| github.com | nats-io_nats-server_v2 | >= 0 < 2.2.0 | 2.2.0 |
| linuxfoundation | nats-server | >= 2.0.0 < 2.2.0 | 2.2.0 |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:N/I:N/A:P
vendor_debian7.5LOW
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Debian
CVE-2020-28466: nats-server - This affects all versions of package github.com/nats-io/nats-server/server. Untr...
vendor_debian·2020·CVSS 7.5
CVE-2020-28466 [HIGH] CVE-2020-28466: nats-server - This affects all versions of package github.com/nats-io/nats-server/server. Untr...
This affects all versions of package github.com/nats-io/nats-server/server. Untrusted accounts are able to crash the server using configs that represent a service export/import cycles. Disclaimer from the maintainers: Running a NATS service which is exposed to untrusted users presents a heightened risk. Any remote execution flaw or equivalent seriousness, or denial-of-service by unauthenticated users, will lead to prompt releases by the NATS maintainers. Fixes for denial of service issues with no threat of remote execution, when limited to account holders, are likely to just be committed to the main development branch with no special attention. Those who are running such services are encouraged to build regularly from git.
Scope: local
bookworm: resolved
forky: resolved
sid: resolved
trixi
OSV
Denial of service in github.com/nats-io/nats-server/server in github.com/nats-io/nats-server
osv·2024-08-21
CVE-2020-28466 Denial of service in github.com/nats-io/nats-server/server in github.com/nats-io/nats-server
Denial of service in github.com/nats-io/nats-server/server in github.com/nats-io/nats-server
Denial of service in github.com/nats-io/nats-server/server in github.com/nats-io/nats-server
GHSA
Denial of service in github.com/nats-io/nats-server/server
ghsa·2022-02-15
CVE-2020-28466 [HIGH] CWE-400 Denial of service in github.com/nats-io/nats-server/server
Denial of service in github.com/nats-io/nats-server/server
This affects all versions of package github.com/nats-io/nats-server/server. Untrusted accounts are able to crash the server using configs that represent a service export/import cycles. Disclaimer from the maintainers - Running a NATS service which is exposed to untrusted users presents a heightened risk. Any remote execution flaw or equivalent seriousness, or denial-of-service by unauthenticated users, will lead to prompt releases by the NATS maintainers. Fixes for denial of service issues with no threat of remote execution, when limited to account holders, are likely to just be committed to the main development branch with no special attention. Those who are running such services are encouraged to build regularly from git.
OSV
Denial of service in github.com/nats-io/nats-server/server
osv·2022-02-15
CVE-2020-28466 [HIGH] Denial of service in github.com/nats-io/nats-server/server
Denial of service in github.com/nats-io/nats-server/server
This affects all versions of package github.com/nats-io/nats-server/server. Untrusted accounts are able to crash the server using configs that represent a service export/import cycles. Disclaimer from the maintainers - Running a NATS service which is exposed to untrusted users presents a heightened risk. Any remote execution flaw or equivalent seriousness, or denial-of-service by unauthenticated users, will lead to prompt releases by the NATS maintainers. Fixes for denial of service issues with no threat of remote execution, when limited to account holders, are likely to just be committed to the main development branch with no special attention. Those who are running such services are encouraged to build regularly from git.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
http://www.openwall.com/lists/oss-security/2021/03/16/1http://www.openwall.com/lists/oss-security/2021/03/16/2https://github.com/nats-io/nats-server/pull/1731https://snyk.io/vuln/SNYK-GOLANG-GITHUBCOMNATSIONATSSERVERSERVER-1042967http://www.openwall.com/lists/oss-security/2021/03/16/1http://www.openwall.com/lists/oss-security/2021/03/16/2https://github.com/nats-io/nats-server/pull/1731https://snyk.io/vuln/SNYK-GOLANG-GITHUBCOMNATSIONATSSERVERSERVER-1042967
2021-03-07
Published