AI and data stack advisories

Severe, 6 weeks1498Projects326

1498 severe, 6 weeks · 326 projects

nats-serverGHSA-vpjc-4jcv-jc29

NATS nats-server allows directory traversal via unintended path to a management action

nats-server

CVE-2022-28357 · Published Sep 19, 2023 · updated Aug 21, 2024

Critical9.8
Fix: upgrade to 2.7.4 or later
GitHub advisory

NATS nats-server 2.2.0 through 2.7.4 allows directory traversal because of an unintended path to a management action from a management account.

Affected versions

PackageAffectedFixed in
github.com/nats-io/nats-server
Go
>= 2.2.0, < 2.7.42.7.4
Details and references
CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Severity from
GitHub (reviewed advisory)
Weakness
CWE-22
Also known as
CVE-2022-28357, GO-2023-2066

More nats-server advisories

All nats-server
High 7.5Aug 21, 2024Integer Overflow or Wraparound in NATS Server in github.com/nats-io/nats-serverCVE-2019-13126no fix yetUnscoredAug 21, 2024Import loops in account imports, nats-server DoS in github.com/nats-io/nats-serverGO-2022-0398no fix yetMedium 6.5Aug 21, 2024Arbitrary file write in nats-server in github.com/nats-io/nats-serverCVE-2022-26652no fix yetHigh 8.8Aug 21, 2024Incorrect Authorization in NATS nats-server in github.com/nats-io/nats-serverCVE-2022-24450no fix yetMedium 6.3Jul 12, 2024NATS Server and Streaming Server fails to enforce negative user permissionsCVE-2022-29946no fix yetUnscoredJun 5, 2024NATS server TLS missing ciphersuite settings when CLI flags used in github.com/nats-io/nats-serverCVE-2021-32026no fix yet