NATS Server v2.14.3 Security Advisory: Fixes for MQTT DoS, JWT Auth, JetStream, and PANIC vulnerabilities

Vulnerability Overview In NATS Server v2.14.3, multiple security-related vulnerabilities and issues have been fixed, primarily including: 1. JWT Default Permission Refresh: When account claims are updated, the inherited JWT default permissions are now refreshed. 2. External Authentication Configuration Cleanup: When account claims are updated, external authentication configurations are now correctly cleaned up. 3. PROXY Protocol Detection: Fixed issues with and PROXY v1 address family parsing. 4. Gateway CONNECT Handling: Fixed race conditions in gateway CONNECT handling. 5. Proxy Tracing: Fixed client leaks caused by concurrent updates in proxy tracing. 6. Service Import Replies: Fixed the forwarding of service import replies across routes. 7. Message Tracing: Fixed message tracing issues in service imports and exports. 8. PANIC Errors: Fixed multiple errors that could cause PANIC, including data races, routing, monitoring, and cluster request handling. 9. MQTT-related Vulnerabilities: Fixed multiple issues in the MQTT protocol, such as packets exhausting pre-authentication memory, remaining length underflow causing server PANIC, denial of subscription to the internal topic, enforcement of subscription denial rules on retained messages and QoS reply paths, and prevention of PANIC during upgrade when MQTT is disabled. 10. JetStream-related Vulnerabilities: Fixed multiple issues in JetStream, including data races on cluster metadata nodes, metadata proposal tracking, stream capture skipping, rejection of TTL and scheduling state, consumer limit handling, Raft node voting and candidacy, Raft checkpoint handling, Raft ApplyCommit, consumer ACK subscription matching, observer state cleanup, atomic batch max size checks and R1 message rewriting, schedule drift, peer decoding, counter stream phase, file store compression, memory store , consumer inactive deletion, , metadata recovery snapshots, skipping message time, and Raft not committing membership changes. Scope of Impact These vulnerabilities and issues may affect users running NATS Server v2.14.3 and earlier versions, particularly in the following scenarios: Users employing JWT authentication and authorization. Users employing the PROXY protocol. Users employing gateway connections. Users employing service imports and exports. Users employing the MQTT protocol. Users employing JetStream. Remediation Upgrading to NATS Server v2.14.3 resolves all the aforementioned vulnerabilities and issues. Specific remediation measures include: 1. JWT Default Permission Refresh: Ensure JWT default permissions are refreshed when account claims are updated. 2. External Authentication Configuration Cleanup: Ensure external authentication configurations are correctly cleaned up when account claims are updated. 3. PROXY Protocol Detection: Fixed and PROXY v1 address family parsing. 4. Gateway CONNECT Handling: Fixed race conditions in gateway CONNECT handling. 5. Proxy Tracing: Fixed client leaks caused by concurrent updates in proxy tracing. 6. Service Import Replies: Fixed forwarding of service import replies across routes. 7. Message Tracing: Fixed message tracing in service imports and exports. 8. PANIC Errors: Fixed multiple errors that could cause PANIC. 9. MQTT-related Vulnerabilities: Fixed multiple issues in the MQTT protocol. 10. JetStream-related Vulnerabilities: Fixed multiple issues in JetStream. POC Code or Exploit Code No specific POC code or exploit code was provided on the page. Summary NATS Server v2.14.3 fixes multiple security-related vulnerabilities and issues. It is recommended that all users upgrade to this version as soon as possible to ensure system security.

Goal Reached Thanks to every supporter — we hit 100%!

NATS Server v2.14.3 Security Advisory: Fixes for MQTT DoS, JWT Auth, JetStream, and PANIC vulnerabilities

More from this source