NATS Server 2.14.1-RC.1 Security Advisory: MQTT Injection, TLS/Cert Fixes

Vulnerability Overview This page summarizes multiple vulnerability fixes and improvements in the NATS Server 2.14.1-RC.1 version. These fixes cover a wide range of aspects, from critical security issues to performance optimizations and stability enhancements. Impact Scope Raft / NRG: Involves cache poisoning, snapshot installation order, snapshot filename validation, and issues with proposing the removal of non-existent peers. JetStream Consumer: Includes panics due to WaitGroup reuse, pending state leaks, failure to replicate to followers, ghost pending peers remaining after deletion, updating deletions not clearing delivered states, and WQ consumer delivery policy checks. Lock Ordering: Involves cMu and dMu ordering, nil dereference in mirrors and sources, error propagation, and skipped errors. File Storage: Includes XOR'd cache resurrection and imprecise cache expiration times. Other Correctness Issues: Involves false positives for prefix existence, negative cache hits for subtopics, routing group ping-pong fields, and concurrency safety during shutdown. Security Fixes: Include MQTT whitespace injection, suppression of invalid topic republishing, TLS certificates with empty Subject + SAN, Proxy Protocol + Required TLS, and FIPS WebSocket handling. Performance / Lock Contention: Involves promoting clients to , starting iteration randomly on updates/deletions, using for subtopic subscriptions, using for stream configuration reads, and sorting stream topic snapshots. Remediation Raft / NRG: - Fixed cache poisoning issues to ensure WAL truncation and snapshot installation correctly invalidate the cache. - Fixed snapshot installation order issues to ensure half-commit state checks are performed after successful snapshot installation. - Fixed snapshot filename validation issues to ensure filename formats are correct. - Fixed issues with proposing the removal of non-existent peers to ensure validation is performed before the proposal. JetStream Consumer: - Fixed panic issues caused by WaitGroup reuse to ensure proper handling when WaitGroups are reused. - Fixed pending state leaks to ensure proper handling during stream and consumer resets. - Fixed replication issues to followers to ensure pending peers are correctly replicated during deletion. - Fixed ghost pending peers left behind after deletion to ensure proper cleanup. - Fixed issues where updates/deletions did not clear delivered states to ensure delivered states are cleared correctly. - Fixed WQ consumer delivery policy check issues to ensure proper handling during delivery policy checks. Lock Ordering: - Fixed cMu and dMu ordering issues to ensure proper handling during lock ordering. - Fixed nil dereference issues in mirrors and sources to ensure proper handling of nil references. - Fixed error propagation issues to ensure proper handling during error propagation. - Fixed skipped error issues to ensure proper handling when errors are skipped. File Storage: - Fixed XOR'd cache resurrection issues to ensure proper handling during XOR'd cache resurrection. - Fixed imprecise cache expiration time issues to ensure proper calculation of cache expiration times. Other Correctness Issues: - Fixed false positives for prefix existence checks to ensure proper handling. - Fixed negative cache hit issues for subtopics to ensure proper handling. - Fixed routing group ping-pong field issues to ensure proper handling. - Fixed concurrency safety issues during shutdown to ensure proper handling. Security Fixes: - Fixed MQTT whitespace injection issues to ensure proper handling. - Fixed suppression of invalid topic republishing issues to ensure proper handling. - Fixed TLS certificate issues with empty Subject + SAN to ensure proper handling. - Fixed Proxy Protocol + Required TLS issues to ensure proper handling. - Fixed FIPS WebSocket handling issues to ensure proper handling. Performance / Lock Contention: - Fixed client promotion to issues to ensure proper handling. - Fixed random start iteration on updates/deletions issues to ensure proper handling. - Fixed subscription subtopic usage of issues to ensure proper handling. - Fixed stream configuration read usage of issues to ensure proper handling. - Fixed stream topic snapshot sorting issues to ensure proper handling. POC Code or Exploit Code No specific POC code or exploit code is included in this page.

Goal Reached Thanks to every supporter — we hit 100%!

NATS Server 2.14.1-RC.1 Security Advisory: MQTT Injection, TLS/Cert Fixes

More from this source