GHSA-9983-vrx2-fg9c
NATS JetStream has an authorization bypass through its Management API
Quick fix
GHSA-9983-vrx2-fg9c — github.com/nats-io/nats-server/v2: upgrade to the fixed version with the command below.
go get github.com/nats-io/nats-server/v2@v2.11.15Details
### Background
NATS.io is a high performance open source pub-sub distributed communication technology, built for the cloud, on-premise, IoT, and edge computing.
The persistent storage feature, JetStream, has a management API which has many features, amongst which are backup and restore.
### Problem Description
Users with JetStream admin API access to restore one stream could restore to other stream names, impacting data which should have been protected against them.
### Affected Versions
Any version before v2.12.6 or v2.11.15
### Workarounds
If developers have configured users to have limited JetStream restore permissions, temporarily remove those permissions.
Are you affected?
Enter the version of the package you're using.
Affected packages
0Fixed in: 2.11.15go get github.com/nats-io/nats-server/v2@v2.11.152.12.0-RC.1Fixed in: 2.12.6go get github.com/nats-io/nats-server/v2@v2.12.60No fixed version published yet for github.com/nats-io/nats-server (go modules). Pin to a known-safe version or switch to an alternative.