CVE-2021-3127: Incorrect Access Control in github.com/nats-io/jwt and github.com/nats-io/nats-server/v2
Summary
CVE-2021-3127: Import token permissions checking not enforced in github.com/nats-io/jwt. Affects github.com/nats-io/jwt versions < 1.2.3-0.20210314221642-a826c77dc9d2. Fixed in 1.2.3-0.20210314221642-a826c77dc9d2. How to fix ↓
Also tracked for
- nats · Bitnami
- github.com/nats-io/jwt/v2 · Go
- github.com/nats-io/nats-server/v2 · Go
- golang-github-nats-io-jwt · Debian:12
The same CVE-2021-3127 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The package under scrutiny is github.com/nats-io/jwt, which is a Go library for JSON Web Tokens (JWT). It provides functionality for creating, parsing, and validating JWTs. The vulnerability also affects github.com/nats-io/nats-server/v2, which is a Go implementation of the NATS messaging system. NATS Server 2.x before 2.2.0 and JWT library before 2.0.1 are impacted by an Incorrect Access Control issue. This vulnerability arises due to mishandling of Import Token bindings.
Vulnerability Detail
The Incorrect Access Control vulnerability in github.com/nats-io/jwt and github.com/nats-io/nats-server/v2 allows unauthorized access to Import Token bindings. This can lead to various security risks, such as unauthorized access to sensitive data or functionality. The vulnerability has a CVSS score of 7.5, indicating a high severity level. It is important to address this issue promptly to prevent potential exploitation.
How To Fix
Minimum fixed version
1.2.3-0.20210314221642-a826c77dc9d2
This is the first release that contains the fix.
go get github.com/nats-io/jwt@v1.2.3-0.20210314221642-a826c77dc9d2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. It is advised to follow the recommended fix and update the affected packages to the fixed versions.
Conclusion
In conclusion, the Incorrect Access Control vulnerability in github.com/nats-io/jwt and github.com/nats-io/nats-server/v2 can lead to unauthorized access to Import Token bindings, posing security risks. It is crucial to update the affected packages to the fixed versions to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for github.com/nats-io/jwt →
FAQ
The vulnerability allows unauthorized access to Import Token bindings, which can result in unauthorized access to sensitive data or functionality.
The CVSS score of this vulnerability is 7.5, indicating a high severity level.
The vulnerability affects github.com/nats-io/jwt and github.com/nats-io/nats-server/v2.
To fix this vulnerability, update the affected packages to their respective fixed versions: github.com/nats-io/jwt 2.0.1 or later, and github.com/nats-io/nats-server/v2 2.2.0 or later.
There is no specific workaround mentioned for this vulnerability. It is recommended to update the affected packages to the fixed versions.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/nats-io/jwt.
