Date: Mon, 2 Nov 2020 12:34:29 -0500 From: Phil Pennock <oss-security-phil@...dhuis.org> To: oss-security@...ts.openwall.com Cc: Phil Pennock <pdp@...adia.com> Subject: [CVE-2020-26521][CVE-2020-26892] NATS JWT vulnerabilities Folks, The NATS project has a new advisories website: <https://advisories.nats.io/> We also have two new CVEs; both relate to our JWT handling and both affect the NATS server: * CVE-2020-26521 + Nil deref in JWT library, causing Go panic + NATS server upgrade required to avoid Denial-of-Service + 2020-11-02 * CVE-2020-26892 + Incorrect credential expiration handling via JWT library + API fixes needed by library users + NATS server upgrade required for expiration to work + 2020-11-02 The text of our advisories should be attached. We have just released NATS server 2.1.9 which includes the fixes for both these issues. Regards, -Phil Pennock View attachment "CVE-2020-26521.txt" of type "text/plain" (1525 bytes) View attachment "CVE-2020-26892.txt" of type "text/plain" (1633 bytes) Download attachment "signature.asc" of type "application/pgp-signature" (229 bytes)
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.