Sensitive data exposure in NATS (GHSA-82rf-q3pr-4f6p)

Description

Preview versions of two NPM packages and one Deno package from the NATS project contain an information disclosure flaw, leaking options to the NATS server; for one package, this includes TLS private credentials.

Recommendation

Update the nats package to the latest compatible version. Followings are version details:

• Affected version(s): >= 2.0.0-201, <= 2.0.0-206
• Patched version(s): 2.0.0-209

References

• GHSA-82rf-q3pr-4f6p
• www.openwall.com
• CVE-2020-26149
• CWE-522
• CAPEC-310
• OWASP 2021-A4
• OWASP 2021-A6

Related Issues

• Sensitive data exposure in NATS - CVE-2020-26149
• Exposure of Sensitive Information to an Unauthorized Actor in AEgir - CVE-2020-11059
• Sensitive Data Exposure in parse-server - CVE-2019-1020013
• Sensitive Data Exposure in seneca - CVE-2019-5483

Tags:

npm

nats