SB2021050457 - Configuration in nats-server

Description

This security bulletin contains information about 1 vulnerability.

1) Configuration (CVE-ID: CVE-2021-32026)

CWE-ID: CWE-16 - Configuration

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows a remote attacker to negotiate unexpected TLS ciphersuites.

The vulnerability exists due to improper configuration handling in the TLS configuration logic when processing command-line TLS parameters. A remote attacker can initiate a TLS connection to negotiate unexpected TLS ciphersuites.

The issue occurs only when the server is started with TLS key and certificate settings supplied through command-line options.

Remediation

Install update from vendor's website.

References

• https://github.com/nats-io/nats-server/security/advisories/GHSA-jj54-5q2m-q7pj
• https://github.com/nats-io/nats-server/commit/ffccc2e1bd