SB2023112001 - Fedora 40 update for golang-github-nats-io, golang-github-nats-io-jwt-2, golang-github-nats-io-nkeys, golang-github-nats-io-streaming-server, nats-server
Published: November 20, 2023
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 2 secuirty vulnerabilities.
1) Resource exhaustion (CVE-ID: CVE-2023-39325)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to excessive consumption of internal resources when handling HTTP/2 requests. A remote attacker can bypass the http2.Server.MaxConcurrentStreams setting by creating new connections while the current connections are still being processed, trigger resource exhaustion and perform a denial of service (DoS) attack.
2) Use of Hard-coded Cryptographic Key (CVE-ID: CVE-2023-46129)
The vulnerability allows a remote attacker to gain access to potentially sensitive information.
The vulnerability exists due to the usage of a hard-coded cryptograhic key. A remote attacker can gain unauthorized access to sensitive information on the system.
Remediation
Install update from vendor's website.