CVE-2019-13126: Integer Overflow or Wraparound in NATS Server
Summary
CVE-2019-13126: Integer Overflow or Wraparound in NATS Server. Affects github.com/nats-io/nats-server/v2 versions < 2.2.0. Fixed in 2.2.0. How to fix ↓
Also tracked for
The same CVE-2019-13126 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The NATS Server is a lightweight and high-performance messaging system that is written in Go. It provides a publish-subscribe model for communication between distributed systems. The vulnerability identified as CVE-2019-13126 is an integer overflow issue that affects NATS Server version 2.0.0. This vulnerability can be exploited by a remote attacker to crash the server by sending a specially crafted request.
Vulnerability Detail
The integer overflow vulnerability in NATS Server 2.0.0 arises due to a lack of proper input validation. When a remote attacker sends a crafted request, it triggers an integer overflow or wraparound condition. This can lead to unexpected behavior, including crashes or denial of service. The severity of this vulnerability is rated as HIGH with a CVSS score of 7.5. It is important to note that this vulnerability has been fixed in version 2.0.2 of NATS Server.
How To Fix
Minimum fixed version
2.2.0
This is the first release that contains the fix.
go get github.com/nats-io/nats-server/v2@v2.2.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. The recommended approach is to upgrade to the fixed version of NATS Server.
Conclusion
The integer overflow vulnerability in NATS Server 2.0.0 can be exploited by a remote attacker to crash the server. It is crucial to upgrade to version 2.0.2 or later to fix this vulnerability. For further assistance with vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for github.com/nats-io/nats-server/v2 →
FAQ
NATS Server is a lightweight and high-performance messaging system that facilitates communication between distributed systems using a publish-subscribe model.
The vulnerability allows a remote attacker to crash the NATS Server by sending a specially crafted request, potentially leading to denial of service.
The severity of this vulnerability is rated as HIGH with a CVSS score of 7.5.
Yes, this vulnerability has been fixed in version 2.0.2 of NATS Server.
To mitigate this vulnerability, it is recommended to upgrade to NATS Server version 2.0.2 or later.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/nats-io/nats-server/v2.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
