Most recent entries from all

BIT-nats-2023-46129 — xkeys Seal encryption used fixed key for all encryption

Affected: Bitnami: nats

NATS.io is a high performance open source pub-sub distributed communication technology, built for the cloud, on-premise, IoT, and edge computing. The cryptographic key handling library, nkeys, recently gained support for encryption, not just for signing/authentication. This is used in nats-server 2.10 (Sep 2023) and newer for authentication callouts. In nkeys versions 0.4.0 through 0.4.5, corresponding with NATS server versions 2.10.0 through 2.10.3, the nkeys library's `xkeys` encryption handling logic mistakenly passed an array by value into an internal function, where the function mutated that buffer to populate the encryption key to use. As a result, all encryption was actually to an all-zeros key. This affects encryption only, not signing. FIXME: FILL IN IMPACT ON NATS-SERVER AUTH CALLOUT SECURITY. nkeys Go library 0.4.6, corresponding with NATS Server 2.10.4, has a patch for this issue. No known workarounds are available. For any application handling auth callouts in Go, if using the nkeys library, update the dependency, recompile and deploy that in lockstep.

certfr-2025-avi-0756 — De multiples vulnérabilités ont été découvertes dans les produits VMware. Elles permettent à un attaquant de provoquer…

certfr-2025-avi-0756

CLEANSTART-2026-JI58569 — Security fix for CVE-2023-46129 applied in: nats-server-fips 2.10.4-r0

Affected: CleanStart: nats-server-fips

Security vulnerability affects the nats-server-fips package. This issue is resolved in later releases. See references for vulnerability details.

EUVD-2026-219599

fkie_cve-2023-46129

GHSA-mr45-rx8q-wcm9 — xkeys seal encryption used fixed key for all encryption

Affected: Go: github.com/nats-io/nkeys, Go: github.com/nats-io/nats-server/v2

## Background

NATS.io is a high performance open source pub-sub distributed communication technology, built for the cloud, on-premise, IoT, and edge computing.

The cryptographic key handling library, nkeys, recently gained support for encryption, not just for signing/authentication. This is used in nats-server 2.10 (Sep 2023) and newer for authentication callouts.

## Problem Description

The nkeys library's "xkeys" encryption handling logic mistakenly passed an array by value into an internal function, where the function mutated that buffer to populate the encryption key to use. As a result, all encryption was actually to an all-zeros key.

This affects encryption only, not signing. FIXME: FILL IN IMPACT ON NATS-SERVER AUTH CALLOUT SECURITY.

## Affected versions

nkeys Go library: * 0.4.0 up to and including 0.4.5 * Fixed with nats-io/nkeys: 0.4.6

NATS Server: * 2.10.0 up to and including 2.10.3 * Fixed with nats-io/nats-server: 2.10.4

## Solution

Upgrade the nats-server. For any application handling auth callouts in Go, if using the nkeys library, update the dependency, recompile and deploy that in lockstep.

## Credits

Problem reported by Quentin Matillat (GitHub @tinou98).

gsd-2023-46129

msrc_CVE-2023-46129 — xkeys Seal encryption used fixed key for all encryption

msrc_CVE-2023-46129

RHSA-2023:7663 — Red Hat Security Advisory: Red Hat OpenShift distributed tracing 3.0.0 operator/operand containers

opentelemetry: DoS vulnerability in otelhttp nkeys: xkeys Seal encryption used fixed key for all encryption

UBUNTU-CVE-2023-46129

Affected: Ubuntu:20.04:LTS: golang-github-nats-io-nkeys, Ubuntu:22.04:LTS: golang-github-nats-io-nkeys

WID-SEC-W-2023-3067 — Red Hat OpenShift: Mehrere Schwachstellen

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Red Hat OpenShift ausnutzen, um einen Denial of Service Angriff durchzuführen und um Sicherheitsmechanismen zu umgehen.