--------------------------------------------------------------------------------
Fedora Update Notification
FEDORA-2023-c33188f575
2023-10-24 01:21:22.156334
--------------------------------------------------------------------------------

Name        : nats-server
Product     : Fedora 38
Version     : 2.10.3
Release     : 1.fc38
URL         : https://github.com/nats-io/nats-server
Summary     : High-Performance server for NATS, the cloud native messaging system
Description :

A High Performance NATS Server written in Go and hosted by the Cloud Native
Computing Foundation (CNCF).

--------------------------------------------------------------------------------
Update Information:

 Without any authorization rules in the nats-server, users can connect without
authentication.  Before nats-server 2.2.0, all authentication and authorization
rules for a nats-server lived in an "authorization" block, defining users.  With
nats-server 2.2.0 all users live inside accounts.  When using the authorization
block, whose syntax predates this, those users will be placed into the implicit
global account, "$G".  Users inside accounts go into the newer "accounts" block.
If an "accounts" block is defined, in simple deployment scenarios this is often
used only to enable client access to the system account.  When the only account
added is the system account "$SYS", the nats-server would create an implicit
user in "$G" and set it as the `no_auth_user` account, enabling the same
"without authentication" logic as without any rules.  This preserved the ability
to connect simply, and then add one authenticated login for system access.  But
with an "authorization" block, this is wrong.  Users exist in the global
account, with login rules.  And in simple testing, they might still connect fine
without administrators seeing that authentication has been disabled.  The blind-
spot on our part came from encouraging and documenting a switch to using only
"accounts", instead of "authorization".  In the fixed versions, using an
"authorization" block will inhibit the implicit creation of a "$G" user and
setting it as the `no_auth_user` target.  In unfixed versions, just creating a
second account, with no users, will also inhibit this behavior.
--------------------------------------------------------------------------------
ChangeLog:

* Sun Oct 15 2023 Mark E. Fuller  - 2.10.3-1
- update to v2.10.3, close rhbz#2244204
* Sat Oct  7 2023 Mark E. Fuller  - 2.10.2-1
- update to v2.10.2, close rhbz#2242568
--------------------------------------------------------------------------------
References:

  [ 1 ] Bug #2244106 - NATS: 2023-01 nats-server: Adding accounts for just the system account adds auth bypass
        https://bugzilla.redhat.com/show_bug.cgi?id=2244106
--------------------------------------------------------------------------------

This update can be installed with the "dnf" update program. Use
su -c 'dnf upgrade --advisory FEDORA-2023-c33188f575' at the command
line. For more information, refer to the dnf documentation available at
https://dnf.readthedocs.io/en/latest/command_ref.html

All packages are signed with the Fedora Project GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------
_______________________________________________
package-announce mailing list -- package-announce@lists.fedoraproject.org
To unsubscribe send an email to package-announce-leave@lists.fedoraproject.org
Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org
Do not reply to spam, report it: https://pagure.io/login/

Fedora 38: nats-server 2023-c33188f575

October 24, 2023
Without any authorization rules in the nats-server, users can connect without authentication

Summary

A High Performance NATS Server written in Go and hosted by the Cloud Native

Computing Foundation (CNCF).

Update Information:

Without any authorization rules in the nats-server, users can connect without authentication. Before nats-server 2.2.0, all authentication and authorization rules for a nats-server lived in an "authorization" block, defining users. With nats-server 2.2.0 all users live inside accounts. When using the authorization block, whose syntax predates this, those users will be placed into the implicit global account, "$G". Users inside accounts go into the newer "accounts" block. If an "accounts" block is defined, in simple deployment scenarios this is often used only to enable client access to the system account. When the only account added is the system account "$SYS", the nats-server would create an implicit user in "$G" and set it as the `no_auth_user` account, enabling the same "without authentication" logic as without any rules. This preserved the ability to connect simply, and then add one authenticated login for system access. But with an "authorization" block, this is wrong. Users exist in the global account, with login rules. And in simple testing, they might still connect fine without administrators seeing that authentication has been disabled. The blind- spot on our part came from encouraging and documenting a switch to using only "accounts", instead of "authorization". In the fixed versions, using an "authorization" block will inhibit the implicit creation of a "$G" user and setting it as the `no_auth_user` target. In unfixed versions, just creating a second account, with no users, will also inhibit this behavior.

Change Log

* Sun Oct 15 2023 Mark E. Fuller - 2.10.3-1 - update to v2.10.3, close rhbz#2244204 * Sat Oct 7 2023 Mark E. Fuller - 2.10.2-1 - update to v2.10.2, close rhbz#2242568

References

[ 1 ] Bug #2244106 - NATS: 2023-01 nats-server: Adding accounts for just the system account adds auth bypass https://bugzilla.redhat.com/show_bug.cgi?id=2244106

Update Instructions

This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2023-c33188f575' at the command line. For more information, refer to the dnf documentation available at https://dnf.readthedocs.io/en/latest/command_ref.html

Severity
Name : nats-server
Product : Fedora 38
Version : 2.10.3
Release : 1.fc38
URL : https://github.com/nats-io/nats-server
Summary : High-Performance server for NATS, the cloud native messaging system

Related News

News

Powered By

Footer Logo

Linux Security - Your source for Top Linux News, Advisories, HowTo's and Feature Release.

Powered By

Footer Logo