nats-io nkeys missing cryptographic step

Summaryinfo

A vulnerability was found in nats-io nkeys. It has been classified as problematic. Affected by this issue is some unknown functionality. The manipulation leads to missing cryptographic step. This vulnerability is referenced as CVE-2023-46129. Remote exploitation of the attack is possible. No exploit is available. It is suggested to install a patch to address this issue.

Detailsinfo

A vulnerability was found in nats-io nkeys (unknown version). It has been rated as problematic. This issue affects an unknown code block. The manipulation with an unknown input leads to a missing cryptographic step vulnerability. Using CWE to declare the problem leads to CWE-325. The product does not implement a required step in a cryptographic algorithm, resulting in weaker encryption than advertised by the algorithm. Impacted is confidentiality. The summary by CVE is:

NATS.io is a high performance open source pub-sub distributed communication technology, built for the cloud, on-premise, IoT, and edge computing. The cryptographic key handling library, nkeys, recently gained support for encryption, not just for signing/authentication. This is used in nats-server 2.10 (Sep 2023) and newer for authentication callouts. In nkeys versions 0.4.0 through 0.4.5, corresponding with NATS server versions 2.10.0 through 2.10.3, the nkeys library's `xkeys` encryption handling logic mistakenly passed an array by value into an internal function, where the function mutated that buffer to populate the encryption key to use. As a result, all encryption was actually to an all-zeros key. This affects encryption only, not signing. FIXME: FILL IN IMPACT ON NATS-SERVER AUTH CALLOUT SECURITY. nkeys Go library 0.4.6, corresponding with NATS Server 2.10.4, has a patch for this issue. No known workarounds are available. For any application handling auth callouts in Go, if using the nkeys library, update the dependency, recompile and deploy that in lockstep.

The weakness was published 10/31/2023 as GHSA-mr45-rx8q-wcm9. The advisory is shared at github.com. The identification of this vulnerability is CVE-2023-46129 since 10/16/2023. Neither technical details nor an exploit are publicly available. MITRE ATT&CK project uses the attack technique T1600 for this issue.

Applying a patch is able to eliminate this problem.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Vendor

• nats-io

Name

• nkeys

Website

• Product: https://github.com/nats-io/nkeys/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion