Ecosyste.ms: Advisories

An open API service providing security vulnerability metadata for many open source software ecosystems.

Security Advisories: GSA_kwCzR0hTQS0yaDJ4LThoaDItbWZxOM4AA90Q

NATS Server and Streaming Server fails to enforce negative user permissions, may allow denied subjects

NATS.io NATS Server before 2.8.2 and Streaming Server before 0.24.6 could allow a remote attacker to bypass security restrictions, caused by the failure to enforce negative user permissions in one scenario. By using a queue subscription on the wildcard, an attacker could exploit this vulnerability to allow denied subjects.

Permalink: https://github.com/advisories/GHSA-2h2x-8hh2-mfq8
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS0yaDJ4LThoaDItbWZxOM4AA90Q
Source: GitHub Advisory Database
Origin: Unspecified
Severity: High
Classification: General
Published: 5 months ago
Updated: 24 days ago


CVSS Score: 6.5
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Identifiers: GHSA-2h2x-8hh2-mfq8, CVE-2022-29946
References: Repository: https://github.com/nats-io/advisories
Blast Radius: 28.6

Affected Packages

go:github.com/nats-io/nats-streaming-server
Dependent packages: 4,332
Dependent repositories: 1,520
Downloads:
Affected Version Ranges: < 0.24.6
Fixed in: 0.24.6
All affected versions: 0.1.0, 0.2.0, 0.2.2, 0.3.0, 0.3.4, 0.3.6, 0.3.8, 0.4.0, 0.5.0, 0.6.0, 0.7.0, 0.7.2, 0.9.0, 0.9.2, 0.10.0, 0.10.2, 0.11.0, 0.11.2, 0.12.0, 0.12.2, 0.14.0, 0.14.1, 0.14.2, 0.14.3, 0.15.0, 0.15.1, 0.16.0, 0.16.2, 0.17.0, 0.18.0, 0.19.0, 0.20.0, 0.21.0, 0.21.1, 0.21.2, 0.22.0, 0.22.1, 0.23.0, 0.23.1, 0.23.2, 0.24.0, 0.24.1, 0.24.2, 0.24.3, 0.24.4, 0.24.5
All unaffected versions: 0.24.6, 0.25.0, 0.25.1, 0.25.2, 0.25.3, 0.25.4, 0.25.5, 0.25.6
go:github.com/nats-io/nats-server/v2
Dependent packages: 6,417
Dependent repositories: 24,884
Downloads:
Affected Version Ranges: < 2.8.2
Fixed in: 2.8.2
All affected versions: 2.0.0, 2.0.2, 2.0.4, 2.1.0, 2.1.2, 2.1.4, 2.1.6, 2.1.7, 2.1.8, 2.1.9, 2.2.0, 2.2.1, 2.2.2, 2.2.3, 2.2.4, 2.2.5, 2.2.6, 2.3.0, 2.3.1, 2.3.2, 2.3.3, 2.3.4, 2.4.0, 2.5.0, 2.6.0, 2.6.1, 2.6.2, 2.6.3, 2.6.4, 2.6.5, 2.6.6, 2.7.0, 2.7.1, 2.7.2, 2.7.3, 2.7.4, 2.8.0, 2.8.1
All unaffected versions: 2.8.2, 2.8.3, 2.8.4, 2.9.0, 2.9.1, 2.9.2, 2.9.3, 2.9.4, 2.9.5, 2.9.6, 2.9.7, 2.9.8, 2.9.9, 2.9.10, 2.9.11, 2.9.12, 2.9.14, 2.9.15, 2.9.16, 2.9.17, 2.9.18, 2.9.19, 2.9.20, 2.9.21, 2.9.22, 2.9.23, 2.9.24, 2.9.25, 2.10.0, 2.10.1, 2.10.2, 2.10.3, 2.10.4, 2.10.5, 2.10.6, 2.10.7, 2.10.8, 2.10.9, 2.10.10, 2.10.11, 2.10.12, 2.10.14, 2.10.15, 2.10.16, 2.10.17, 2.10.18, 2.10.19, 2.10.20, 2.10.21, 2.10.22