CVE-2021-3127: Incorrect Access Control in github.com/nats-io/jwt and github.com/nats-io/nats-server/v2
Summary
CVE-2021-3127: Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-62mh-w5cv-p88c (for github.com/nats-io/jwt) and GHSA-j756-f273-xhp4 (for github.com/nats-io/nats-server). Affects github.com/nats-io/jwt/v2 versions < 2.0.1. Fixed in 2.0.1. How to fix ↓
Also tracked for
- nats · Bitnami
- github.com/nats-io/jwt · Go
- github.com/nats-io/jwt · Go
- github.com/nats-io/jwt · Go
- github.com/nats-io/nats-server/v2 · Go
- golang-github-nats-io-jwt · Debian:12
The same CVE-2021-3127 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The package under scrutiny is github.com/nats-io/jwt/v2, which is a JWT library written in Go. It provides functionality for handling JSON Web Tokens (JWTs) in applications. The vulnerability also affects github.com/nats-io/nats-server/v2, which is the NATS Server written in Go. NATS Server is a lightweight and high-performance messaging system. Both packages are widely used in various applications.
Vulnerability Detail
The vulnerability, identified as CVE-2021-3127, arises due to incorrect access control in the affected packages. Specifically, the Import Token bindings are mishandled in NATS Server 2.x before version 2.2.0 and JWT library before version 2.0.1. This vulnerability can lead to unauthorized access and potential security breaches. The severity of this vulnerability is rated as HIGH with a CVSS score of 7.5.
How To Fix
Minimum fixed version
2.0.1
This is the first release that contains the fix.
go get github.com/nats-io/jwt/v2@v2.0.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. It is advised to update the packages to the fixed versions as mentioned in the 'how_to_fix' section.
Conclusion
In conclusion, the vulnerability CVE-2021-3127 affects github.com/nats-io/jwt/v2 and github.com/nats-io/nats-server/v2. It is crucial to update the affected packages to the fixed versions (2.0.1 or later for github.com/nats-io/jwt/v2 and 2.2.0 or later for github.com/nats-io/nats-server/v2) to mitigate the risk of unauthorized access and potential security breaches. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for github.com/nats-io/jwt/v2 →
FAQ
This vulnerability can lead to unauthorized access and potential security breaches in applications that use the affected packages.
No, only versions before the fixed versions are affected. For github.com/nats-io/jwt/v2, versions before 2.0.1 are vulnerable. For github.com/nats-io/nats-server/v2, versions before 2.2.0 are vulnerable.
There is no specific information about known exploits for this vulnerability. However, it is recommended to update the packages to the fixed versions to mitigate any potential risks.
Yes, this vulnerability can be exploited remotely as it involves incorrect access control in the affected packages.
Yes, you can find more information about this vulnerability in the advisory database provided by GitHub. The link to the advisory database is mentioned in the 'affected' section of the vulnerability details.
