NATS.io is a high performance open source pub-sub distributed communication technology, built for the cloud, on-premise, IoT, and edge computing. The cryptographic key handling library, nkeys, recently gained support for encryption, not just for signing/authentication. This is used in nats-server 2.10 (Sep 2023) and newer for authentication callouts. In nkeys versions 0.4.0 through 0.4.5, corresponding with NATS server versions 2.10.0 through 2.10.3, the nkeys library's `xkeys` encryption handling logic mistakenly passed an array by value into an internal function, where the function mutated that buffer to populate the encryption key to use. As a result, all encryption was actually to an all-zeros key. This affects encryption only, not signing. FIXME: FILL IN IMPACT ON NATS-SERVER AUTH CALLOUT SECURITY. nkeys Go library 0.4.6, corresponding with NATS Server 2.10.4, has a patch for this issue. No known workarounds are available. For any application handling auth callouts in Go, if using the nkeys library, update the dependency, recompile and deploy that in lockstep.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - NATS.io is a high performance open source pub-sub distributed communication technology, built for the     cloud, on-premise, IoT, and edge computing. The cryptographic key handling library, nkeys, recently gained     support for encryption, not just for signing/authentication. This is used in nats-server 2.10 (Sep 2023)     and newer for authentication callouts. In nkeys versions 0.4.0 through 0.4.5, corresponding with NATS     server versions 2.10.0 through 2.10.3, the nkeys library's `xkeys` encryption handling logic mistakenly     passed an array by value into an internal function, where the function mutated that buffer to populate the     encryption key to use. As a result, all encryption was actually to an all-zeros key. This affects     encryption only, not signing. FIXME: FILL IN IMPACT ON NATS-SERVER AUTH CALLOUT SECURITY. nkeys Go library     0.4.6, corresponding with NATS Server 2.10.4, has a patch for this issue. No known workarounds are     available. For any application handling auth callouts in Go, if using the nkeys library, update the     dependency, recompile and deploy that in lockstep. (CVE-2023-46129)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - NATS.io is a high performance open source pub-sub distributed communication technology, built for the
    cloud, on-premise, IoT, and edge computing. The cryptographic key handling library, nkeys, recently gained
    support for encryption, not just for signing/authentication. This is used in nats-server 2.10 (Sep 2023)
    and newer for authentication callouts. In nkeys versions 0.4.0 through 0.4.5, corresponding with NATS
    server versions 2.10.0 through 2.10.3, the nkeys library's `xkeys` encryption handling logic mistakenly
    passed an array by value into an internal function, where the function mutated that buffer to populate the
    encryption key to use. As a result, all encryption was actually to an all-zeros key. This affects
    encryption only, not signing. FIXME: FILL IN IMPACT ON NATS-SERVER AUTH CALLOUT SECURITY. nkeys Go library
    0.4.6, corresponding with NATS Server 2.10.4, has a patch for this issue. No known workarounds are
    available. For any application handling auth callouts in Go, if using the nkeys library, update the
    dependency, recompile and deploy that in lockstep. (CVE-2023-46129)

The remote Fedora 40 host has packages installed that are affected by multiple vulnerabilities as referenced in the FEDORA-2023-5f984129b2 advisory.

    Updated NATS stack for CVE-2023-39325 and CVE-2023-46129

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 39 host has packages installed that are affected by multiple vulnerabilities as referenced in the FEDORA-2023-3a895ff65c advisory.

    Updated NATS stack for CVE-2023-39325 and CVE-2023-46129

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 38 host has packages installed that are affected by multiple vulnerabilities as referenced in the FEDORA-2023-66966ae3d0 advisory.

    Updated NATS stack for CVE-2023-39325 and CVE-2023-46129

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of telegraf installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2023-46129 advisory.

  - NATS.io is a high performance open source pub-sub distributed communication technology, built for the     cloud, on-premise, IoT, and edge computing. The cryptographic key handling library, nkeys, recently gained     support for encryption, not just for signing/authentication. This is used in nats-server 2.10 (September 2023)     and newer for authentication callouts. In nkeys versions 0.4.0 through 0.4.5, corresponding with NATS     server versions 2.10.0 through 2.10.3, the nkeys library's `xkeys` encryption handling logic mistakenly     passed an array by value into an internal function, where the function mutated that buffer to populate the     encryption key to use. As a result, all encryption was actually to an all-zeros key. This affects     encryption only, not signing. FIXME: FILL IN IMPACT ON NATS-SERVER AUTH CALLOUT SECURITY. nkeys Go library     0.4.6, corresponding with NATS Server 2.10.4, has a patch for this issue. No known workarounds are     available. For any application handling auth callouts in Go, if using the nkeys library, update the     dependency, recompile and deploy that in lockstep. (CVE-2023-46129)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
250974	Linux Distros Unpatched Vulnerability : CVE-2023-46129	Nessus	Misc.	high
417105	SCA: security update for github.com/nats-io/nats-server/v2, github.com/nats-io/nkeys (GHSA-mr45-rx8q-wcm9)	Tenable Cloud Security	SCA Checks	high
417105	SCA: security update for github.com/nats-io/nats-server/v2, github.com/nats-io/nkeys (GHSA-mr45-rx8q-wcm9)	Tenable Self-Hosted Container Security	SCA Checks	high
194507	Fedora 40 : golang-github-nats-io / golang-github-nats-io-jwt-2 / etc (2023-5f984129b2)	Nessus	Fedora Local Security Checks	high
408088	Alpine: nats-server: security update to 2.10.4-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	high
408088	Alpine: nats-server: security update to 2.10.4-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	high
186386	Fedora 39 : golang-github-nats-io / golang-github-nats-io-jwt-2 / etc (2023-3a895ff65c)	Nessus	Fedora Local Security Checks	high
186385	Fedora 38 : golang-github-nats-io / golang-github-nats-io-jwt-2 / etc (2023-66966ae3d0)	Nessus	Fedora Local Security Checks	high
185990	CBL Mariner 2.0 Security Update: telegraf (CVE-2023-46129)	Nessus	MarinerOS Local Security Checks	high

Detections

Analytics

CVE-2023-46129

high

Tenable Plugins

high

high

high

high

high

high

high

high

high