cbcvebase.
CVE-2023-46129
published 2023-10-31

CVE-2023-46129: NATS.io is a high performance open source pub-sub distributed communication technology, built for the cloud, on-premise, IoT, and edge computing. The…

PriorityP345high7.5CVSS 3.1
AVNACLPRNUINSUCHINAN
EPSS
0.37%
29.2th percentile
NATS.io is a high performance open source pub-sub distributed communication technology, built for the cloud, on-premise, IoT, and edge computing. The cryptographic key handling library, nkeys, recently gained support for encryption, not just for signing/authentication. This is used in nats-server 2.10 (Sep 2023) and newer for authentication callouts. In nkeys versions 0.4.0 through 0.4.5, corresponding with NATS server versions 2.10.0 through 2.10.3, the nkeys library's `xkeys` encryption handling logic mistakenly passed an array by value into an internal function, where the function mutated that buffer to populate the encryption key to use. As a result, all encryption was actually to an all-zeros key. This affects encryption only, not signing. FIXME: FILL IN IMPACT ON NATS-SERVER AUTH CALLOUT SECURITY. nkeys Go library 0.4.6, corresponding with NATS Server 2.10.4, has a patch for this issue. No known workarounds are available. For any application handling auth callouts in Go, if using the nkeys library, update the dependency, recompile and deploy that in lockstep.

Affected

17 ranges
VendorProductVersion rangeFixed in
debiangolang-github-nats-io-nkeys< golang-github-nats-io-nkeys 0.4.6-1 (forky)golang-github-nats-io-nkeys 0.4.6-1 (forky)
debiannats-server< golang-github-nats-io-nkeys 0.4.6-1 (forky)golang-github-nats-io-nkeys 0.4.6-1 (forky)
github.comnats-io_nats-server_v2>= 2.10.0 < 2.10.42.10.4
github.comnats-io_nkeys>= 0.4.0 < 0.4.60.4.6
linuxfoundationnats-server>= 0 < 2.10.4-12.10.4-1
linuxfoundationnats-server>= 0 < 2.10.4-12.10.4-1
linuxfoundationnats-server>= 2.10.0 < 2.10.42.10.4
msrcazl3_telegraf_1.27.3-4_on_azure_linux_3.0
msrcazl3_telegraf_1.29.4-1_on_azure_linux_3.0
msrcazure_linux_3.0_arm
msrcazure_linux_3.0_x64
msrccbl2_telegraf_1.27.4-1_on_cbl_mariner_2.0
msrccbl_mariner_2.0_arm
msrccbl_mariner_2.0_x64
nats-ionkeys
nats-ionkeys
natsnkeys>= 0.4.0 < 0.4.60.4.6

CVSS provenance

nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
osv7.5HIGH
vendor_debian7.5LOW
vendor_msrc7.5HIGH
vendor_redhat7.5HIGH
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.