GHSA-4frv-5fj6-4p25

Source

https://github.com/advisories/GHSA-4frv-5fj6-4p25

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/10/GHSA-4frv-5fj6-4p25/GHSA-4frv-5fj6-4p25.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-4frv-5fj6-4p25

Withdrawn

2023-10-31T22:24:21Z

Published

2023-10-30T18:30:25Z

Modified

2023-10-31T22:24:49Z

Summary

Duplicate Advisory: NATS.io: Adding accounts for just the system account adds auth bypass

Details

Duplicate Advisory

This advisory has been withdrawn because it is a duplicate of GHSA-fr2g-9hjm-wr23. This link is maintained to preserve external references.

Original Description

NATS nats-server before 2.9.23 and 2.10.x before 2.10.2 has an authentication bypass. An implicit $G user in an authorization block can sometimes be used for unauthenticated access, even when the intention of the configuration was for each user to have an account. The earliest affected version is 2.2.0.

Database specific

{
    "nvd_published_at": "2023-10-30T17:15:52Z",
    "cwe_ids": [],
    "severity": "MODERATE",
    "github_reviewed": true,
    "github_reviewed_at": "2023-10-31T22:24:21Z"
}

References

Affected packages

Go / github.com/nats-io/nats-server/v2

Package

Name: github.com/nats-io/nats-server/v2; View open source insights on deps.dev
Purl: pkg:golang/github.com/nats-io/nats-server/v2

Affected ranges

Type: SEMVER
Events: Introduced

2.2.0

Fixed

2.9.23

Go / github.com/nats-io/nats-server/v2

Package

Name: github.com/nats-io/nats-server/v2; View open source insights on deps.dev
Purl: pkg:golang/github.com/nats-io/nats-server/v2

Affected ranges

Type: SEMVER
Events: Introduced

2.10.0

Fixed

2.10.2