CVE-2020-26892

Опубликовано: 06 нояб. 2020

Источник: nvd

CVSS3: 9.8

CVSS2: 7.5

EPSS Низкий

Описание

The JWT library in NATS nats-server before 2.1.9 has Incorrect Access Control because of how expired credentials are handled.

Ссылки

https://github.com/nats-io/nats-server/commits/master
Patch
Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VT67XCLIIBYRT762SVFBYFFTQFVSM3SI/
https://www.openwall.com/lists/oss-security/2020/11/02/2
Mailing List
Third Party Advisory
https://github.com/nats-io/nats-server/commits/master
Patch
Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VT67XCLIIBYRT762SVFBYFFTQFVSM3SI/
https://www.openwall.com/lists/oss-security/2020/11/02/2
Mailing List
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:linuxfoundation:nats-server:*:*:*:*:*:*:*:*

Версия до 2.1.9 (исключая)

Конфигурация 2

cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:*

EPSS

Процентиль: 80%

0.02079

Низкий

9.8 Critical

CVSS3

7.5 High

CVSS2

Дефекты

CWE-798

Связанные уязвимости

CVE-2020-26892

CVSS3: 9.8

ubuntu

почти 6 лет назад

The JWT library in NATS nats-server before 2.1.9 has Incorrect Access Control because of how expired credentials are handled.

CVE-2020-26892

CVSS3: 9.8

debian

почти 6 лет назад

The JWT library in NATS nats-server before 2.1.9 has Incorrect Access ...

GHSA-4w5x-x539-ppf5

CVSS3: 9.8

github

больше 4 лет назад

Incorrect handling of credential expiry by /nats-io/nats-server

EPSS

Процентиль: 80%

0.02079

Низкий

9.8 Critical

CVSS3

7.5 High

CVSS2

Дефекты

CWE-798