CVE-2021-32026
published 2024-06-05CVE-2021-32026: NATS server TLS missing ciphersuite settings when CLI flags used in github.com/nats-io/nats-server NATS server TLS missing ciphersuite settings when CLI flags…
NATS server TLS missing ciphersuite settings when CLI flags used in github.com/nats-io/nats-server
NATS server TLS missing ciphersuite settings when CLI flags used in github.com/nats-io/nats-server
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| github.com | nats-io_nats-server_v2 | >= 0 < 2.2.3 | 2.2.3 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
NATS server TLS missing ciphersuite settings when CLI flags used in github.com/nats-io/nats-server
osv·2024-06-05
CVE-2021-32026 NATS server TLS missing ciphersuite settings when CLI flags used in github.com/nats-io/nats-server
NATS server TLS missing ciphersuite settings when CLI flags used in github.com/nats-io/nats-server
NATS server TLS missing ciphersuite settings when CLI flags used in github.com/nats-io/nats-server
GHSA
NATS server TLS missing ciphersuite settings when CLI flags used
ghsa·2024-05-14
CVE-2021-32026 [LOW] NATS server TLS missing ciphersuite settings when CLI flags used
NATS server TLS missing ciphersuite settings when CLI flags used
(This advisory is canonically )
### Problem Description
The NATS server by default uses a restricted set of modern ciphersuites for TLS. This selection can be overridden through configuration. The defaults include just RSA and ECDSA with either AES/GCM with a SHA2 digest or ChaCha20/Poly1305.
The configuration system allows for extensive use of CLI options to override configuration settings. When using these to set a key/cert for TLS, the restricted ciphersuite settings were lost, enabling all ciphersuites supported by Go by default.
None of these additional ciphersuites are broken, so the NATS maintainers have fixed this in public git and the next release is not being hurried, nor is this security advisory embargoed.
OSV
NATS server TLS missing ciphersuite settings when CLI flags used
osv·2024-05-14
CVE-2021-32026 [LOW] NATS server TLS missing ciphersuite settings when CLI flags used
NATS server TLS missing ciphersuite settings when CLI flags used
(This advisory is canonically )
### Problem Description
The NATS server by default uses a restricted set of modern ciphersuites for TLS. This selection can be overridden through configuration. The defaults include just RSA and ECDSA with either AES/GCM with a SHA2 digest or ChaCha20/Poly1305.
The configuration system allows for extensive use of CLI options to override configuration settings. When using these to set a key/cert for TLS, the restricted ciphersuite settings were lost, enabling all ciphersuites supported by Go by default.
None of these additional ciphersuites are broken, so the NATS maintainers have fixed this in public git and the next release is not being hurried, nor is this security advisory embargoed.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2024-06-05
Published