Sign-up

ID

VAR-202310-1531


CVE

CVE-2023-46129


TITLE

NATS  of  NATS Server  and  nkeys  Vulnerability related to the use of hard-coded encryption keys in

Trust: 0.8

sources: JVNDB: JVNDB-2023-015964

DESCRIPTION

NATS.io is a high performance open source pub-sub distributed communication technology, built for the cloud, on-premise, IoT, and edge computing. The cryptographic key handling library, nkeys, recently gained support for encryption, not just for signing/authentication. This is used in nats-server 2.10 (Sep 2023) and newer for authentication callouts. In nkeys versions 0.4.0 through 0.4.5, corresponding with NATS server versions 2.10.0 through 2.10.3, the nkeys library's `xkeys` encryption handling logic mistakenly passed an array by value into an internal function, where the function mutated that buffer to populate the encryption key to use. As a result, all encryption was actually to an all-zeros key. This affects encryption only, not signing. FIXME: FILL IN IMPACT ON NATS-SERVER AUTH CALLOUT SECURITY. nkeys Go library 0.4.6, corresponding with NATS Server 2.10.4, has a patch for this issue. No known workarounds are available. For any application handling auth callouts in Go, if using the nkeys library, update the dependency, recompile and deploy that in lockstep. NATS of NATS Server and nkeys contains vulnerabilities related to the use of hard-coded encryption keys and vulnerabilities related to flaws in the encryption process.Information may be obtained

Trust: 1.71

sources: NVD: CVE-2023-46129 // JVNDB: JVNDB-2023-015964 // VULMON: CVE-2023-46129

AFFECTED PRODUCTS

vendor:natsmodel:serverscope:gteversion:2.10.0

Trust: 1.0

vendor:natsmodel:nkeysscope:gteversion:0.4.0

Trust: 1.0

vendor:natsmodel:serverscope:ltversion:2.10.4

Trust: 1.0

vendor:natsmodel:nkeysscope:ltversion:0.4.6

Trust: 1.0

vendor:natsmodel:nkeysscope: - version: -

Trust: 0.8

vendor:natsmodel:serverscope: - version: -

Trust: 0.8

sources: JVNDB: JVNDB-2023-015964 // NVD: CVE-2023-46129

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2023-46129
value: HIGH

Trust: 1.0

security-advisories@github.com: CVE-2023-46129
value: HIGH

Trust: 1.0

NVD: CVE-2023-46129
value: HIGH

Trust: 0.8

nvd@nist.gov: CVE-2023-46129
baseSeverity: HIGH
baseScore: 7.5
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: 3.9
impactScore: 3.6
version: 3.1

Trust: 2.0

NVD: CVE-2023-46129
baseSeverity: HIGH
baseScore: 7.5
vectorString: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: NONE
impactScore: NONE
version: 3.0

Trust: 0.8

sources: JVNDB: JVNDB-2023-015964 // NVD: CVE-2023-46129 // NVD: CVE-2023-46129

PROBLEMTYPE DATA

problemtype:CWE-321

Trust: 1.0

problemtype:CWE-325

Trust: 1.0

problemtype:Using hardcoded encryption keys (CWE-321) [ others ]

Trust: 0.8

problemtype: Inadequate encryption processing (CWE-325) [ others ]

Trust: 0.8

sources: JVNDB: JVNDB-2023-015964 // NVD: CVE-2023-46129

PATCH

title:Debian CVElist Bug Report Logs: golang-github-nats-io-nkeys: CVE-2023-46129url:https://vulmon.com/vendoradvisory?qidtp=debian_cvelist_bugreportlogs&qid=1b947156b93d5526f9c7f90eda21d808

Trust: 0.1

sources: VULMON: CVE-2023-46129

EXTERNAL IDS

db:NVDid:CVE-2023-46129

Trust: 2.7

db:OPENWALLid:OSS-SECURITY/2023/10/31/1

Trust: 1.9

db:JVNDBid:JVNDB-2023-015964

Trust: 0.8

db:VULMONid:CVE-2023-46129

Trust: 0.1

sources: VULMON: CVE-2023-46129 // JVNDB: JVNDB-2023-015964 // NVD: CVE-2023-46129

REFERENCES

url:https://github.com/nats-io/nkeys/security/advisories/ghsa-mr45-rx8q-wcm9

Trust: 1.9

url:http://www.openwall.com/lists/oss-security/2023/10/31/1

Trust: 1.9

url:https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/r3uetkpub3v5js5tlzof3smtgt5k5aps/

Trust: 1.8

url:https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ulqqonmscqsh5z5owffqhcgez3nl4drj/

Trust: 1.8

url:https://nvd.nist.gov/vuln/detail/cve-2023-46129

Trust: 0.8

url:https://cwe.mitre.org/data/definitions/321.html

Trust: 0.1

url:https://cwe.mitre.org/data/definitions/325.html

Trust: 0.1

url:https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1055010

Trust: 0.1

url:https://nvd.nist.gov

Trust: 0.1

sources: VULMON: CVE-2023-46129 // JVNDB: JVNDB-2023-015964 // NVD: CVE-2023-46129

SOURCES

db:VULMONid:CVE-2023-46129
db:JVNDBid:JVNDB-2023-015964
db:NVDid:CVE-2023-46129

LAST UPDATE DATE

2024-08-14T15:20:50.426000+00:00


SOURCES UPDATE DATE

db:VULMONid:CVE-2023-46129date:2023-10-31T00:00:00
db:JVNDBid:JVNDB-2023-015964date:2023-12-28T06:13:00
db:NVDid:CVE-2023-46129date:2023-11-29T03:15:42.270

SOURCES RELEASE DATE

db:VULMONid:CVE-2023-46129date:2023-10-31T00:00:00
db:JVNDBid:JVNDB-2023-015964date:2023-12-28T00:00:00
db:NVDid:CVE-2023-46129date:2023-10-31T00:15:09.933