NATS Server v2.12.9 Security Patch: TLS, JetStream, and MQTT Vulnerabilities

Vulnerability Overview In NATS Server v2.12.9, several vulnerabilities and issues related to security and stability have been fixed. The fixes primarily cover the following areas: 1. TLS-related vulnerabilities: - Fixed an issue where TLS handshake timeouts or non-TLS errors were downgraded to debug level, reducing log noise. - Fixed an issue where client TLS certificates were rejected when lacking subdomain DNS entries but possessing DNS Subject Alternative Names (SANs). 2. Memory and performance issues: - Fixed potential deadlocks occurring during cluster processing. - Fixed an issue where the sublist cache option was incorrectly ignored. - Fixed an issue where cluster route compression now correctly adheres to the configuration. - Fixed an internal send loop that was modifying the caller's headers, potentially corrupting buffers. - Fixed an issue where removing headers failed to remove subsequent headers if the matching prefix also appeared in earlier header values. - Fixed an issue where the sublist now correctly maintains negative results in the cache when calculating the number of interested topics. - Fixed server shutdown requests to be non-preemptive, preventing concurrency issues during shutdown in embedded contexts. - Fixed TLS listeners to work correctly with the PROXY protocol enabled. - Fixed reduced lock contention, which could create issues between leaders and clients. - Fixed a panic that could occur when traversing directories in the JWT directory resolver folder. - Fixed process-in-connection falling back unexpectedly to requiring asynchronous TLS. 3. JetStream-related vulnerabilities: - Fixed atomic batching to send a "not supported" warning now when there is an API-level mismatch. - Fixed a crash when calculating message scheduling topic recovery. - Fixed lock contention issues during node leader changes and Raft group creation. - Fixed issues potentially caused by double-encoded reply topics triggered via routes or gateways. - Fixed a panic that could occur when decoding truncated Raft append entries. - Fixed atomic batching to no longer submit entries upon double pooling cleanup. - Fixed Raft nodes to ignore temporary snapshots after recovery. - Fixed a code path that could cause consumers to redeliver messages while in a drift state. - Fixed the cache to clear correctly when converting file storage encryption types, preventing block-level corruption. - Fixed a race condition when updating scheduling maps during leader changes. - Fixed source consumer issues to no longer schedule recreation if a recreation is already in progress, avoiding potential storms. - Fixed a data race when checking retention while reading from stream configuration. - Fixed stream republish topics to be correctly validated. - Fixed delivery policies for consumers on cluster workqueue streams to be enforced. - Fixed Raft node append entry cache to be correctly invalidated during WAL truncation and snapshots. - Fixed skip message errors to be correctly propagated. - Fixed mirror consumers to retry immediately, avoiding long stalls. - Fixed Raft nodes to no longer allow proposals to delete unknown peers. - Fixed stream cluster status when resetting the wait group. - Fixed the local metadata log to be correctly reset when expanding tuples to the parent domain. - Fixed file storage to flush correctly when deleting individual redeliveries, preventing unintended further redeliveries. - Fixed storage retention on unbounded streams to be consistent between create/update and cluster/non-cluster modes. - Fixed Raft to correctly cancel in-flight checkpoint operations in embedded mode. - Fixed the and options to be handled correctly in embedded mode. - Fixed alias underlying file storage block caching issues. - Fixed consumers with from unexpectedly deleting their local state when proposals to clean up metadata consumers fail. - Fixed metadata status to be preserved in multiple scenarios where it was previously deleted incorrectly. 4. MQTT-related vulnerabilities: - Fixed invalid characters in topics to be correctly rejected, preventing protocol issues when forwarding to other connection types. Impact Scope These vulnerabilities and issues affect multiple aspects of NATS Server, including TLS security, memory management, performance optimization, JetStream functionality, and MQTT protocol handling. The specific impact scope includes: TLS Security: May lead to TLS handshake failures or incorrect logging, affecting communication security. Memory and Performance: May lead to deadlocks, memory corruption, performance degradation, etc., affecting system stability and response speed. JetStream Functionality: May lead to data loss, state inconsistency, performance issues, etc., affecting the reliability and efficiency of message delivery. MQTT Protocol: May lead to protocol errors, affecting compatibility with other connection types. Remediation 1. TLS-related fixes: - Update TLS configuration to ensure error messages are recorded

Goal Reached Thanks to every supporter — we hit 100%!

NATS Server v2.12.9 Security Patch: TLS, JetStream, and MQTT Vulnerabilities

More from this source