NATS.io is a high performance open source pub-sub distributed communication technology, built for the cloud, on-premise, IoT, and edge computing. The cryptographic key handling library, nkeys, recently gained support for encryption, not just for signing/authentication. This is used in nats-server 2.10 (Sep 2023) and newer for authentication callouts. In nkeys versions 0.4.0 through 0.4.5, corresponding with NATS server versions 2.10.0 through 2.10.3, the nkeys library's `xkeys` encryption handling logic mistakenly passed an array by value into an internal function, where the function mutated that buffer to populate the encryption key to use. As a result, all encryption was actually to an all-zeros key. This affects encryption only, not signing. FIXME: FILL IN IMPACT ON NATS-SERVER AUTH CALLOUT SECURITY. nkeys Go library 0.4.6, corresponding with NATS Server 2.10.4, has a patch for this issue. No known workarounds are available. For any application handling auth callouts in Go, if using the nkeys library, update the dependency, recompile and deploy that in lockstep.

The remote Fedora 40 host has packages installed that are affected by multiple vulnerabilities as referenced in the FEDORA-2023-5f984129b2 advisory.

    Updated NATS stack for CVE-2023-39325 and CVE-2023-46129

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 39 host has packages installed that are affected by multiple vulnerabilities as referenced in the FEDORA-2023-3a895ff65c advisory.

    Updated NATS stack for CVE-2023-39325 and CVE-2023-46129

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 38 host has packages installed that are affected by multiple vulnerabilities as referenced in the FEDORA-2023-66966ae3d0 advisory.

    Updated NATS stack for CVE-2023-39325 and CVE-2023-46129

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of telegraf installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2023-46129 advisory.

  - NATS.io is a high performance open source pub-sub distributed communication technology, built for the     cloud, on-premise, IoT, and edge computing. The cryptographic key handling library, nkeys, recently gained     support for encryption, not just for signing/authentication. This is used in nats-server 2.10 (September 2023)     and newer for authentication callouts. In nkeys versions 0.4.0 through 0.4.5, corresponding with NATS     server versions 2.10.0 through 2.10.3, the nkeys library's `xkeys` encryption handling logic mistakenly     passed an array by value into an internal function, where the function mutated that buffer to populate the     encryption key to use. As a result, all encryption was actually to an all-zeros key. This affects     encryption only, not signing. FIXME: FILL IN IMPACT ON NATS-SERVER AUTH CALLOUT SECURITY. nkeys Go library     0.4.6, corresponding with NATS Server 2.10.4, has a patch for this issue. No known workarounds are     available. For any application handling auth callouts in Go, if using the nkeys library, update the     dependency, recompile and deploy that in lockstep. (CVE-2023-46129)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
194507	Fedora 40 : golang-github-nats-io / golang-github-nats-io-jwt-2 / etc (2023-5f984129b2)	Nessus	Fedora Local Security Checks	high
186386	Fedora 39 : golang-github-nats-io / golang-github-nats-io-jwt-2 / etc (2023-3a895ff65c)	Nessus	Fedora Local Security Checks	high
186385	Fedora 38 : golang-github-nats-io / golang-github-nats-io-jwt-2 / etc (2023-66966ae3d0)	Nessus	Fedora Local Security Checks	high
185990	CBL Mariner 2.0 Security Update: telegraf (CVE-2023-46129)	Nessus	MarinerOS Local Security Checks	high

Detections

Analytics

CVE-2023-46129

high

Tenable Plugins

high

high

high

high