chore(deps): update module github.com/nats-io/nkeys to v0.4.6 [security] - autoclosed

[renovate]

This PR contains the following updates:

Package	Type	Update	Change
github.com/nats-io/nkeys	indirect	patch	v0.4.4 -> v0.4.6

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

GitHub Vulnerability Alerts

CVE-2023-46129

Background

NATS.io is a high performance open source pub-sub distributed communication technology, built for the cloud, on-premise, IoT, and edge computing.

The cryptographic key handling library, nkeys, recently gained support for encryption, not just for signing/authentication. This is used in nats-server 2.10 (Sep 2023) and newer for authentication callouts.

Problem Description

The nkeys library's "xkeys" encryption handling logic mistakenly passed an array by value into an internal function, where the function mutated that buffer to populate the encryption key to use. As a result, all encryption was actually to an all-zeros key.

This affects encryption only, not signing.
FIXME: FILL IN IMPACT ON NATS-SERVER AUTH CALLOUT SECURITY.

Affected versions

nkeys Go library:

• 0.4.0 up to and including 0.4.5
• Fixed with nats-io/nkeys: 0.4.6

NATS Server:

• 2.10.0 up to and including 2.10.3
• Fixed with nats-io/nats-server: 2.10.4

Solution

Upgrade the nats-server.
For any application handling auth callouts in Go, if using the nkeys library, update the dependency, recompile and deploy that in lockstep.

Credits

Problem reported by Quentin Matillat (GitHub @​tinou98).

---

Release Notes

nats-io/nkeys (github.com/nats-io/nkeys)

v0.4.6

Compare Source

What's Changed

• [FIXED] Make sure to use byte slice to receive proper copy by @​derekcollison in https://github.com/nats-io/nkeys/pull/59
• [BUMP] release version and dependencies by @​aricart in https://github.com/nats-io/nkeys/pull/60

Full Changelog: nats-io/nkeys@v0.4.5...v0.4.6

v0.4.5

Compare Source

What's Changed

• [CI] bump staticcheck GHAction by @​philpennock in https://github.com/nats-io/nkeys/pull/49
• [FIX] added windows binary by @​aricart in https://github.com/nats-io/nkeys/pull/51
• [FIX] YAML Enginering: quote go-version string by @​philpennock in https://github.com/nats-io/nkeys/pull/53
• [FEAT] Use readKeyFile to read both seed file and public key file by @​nanjj in https://github.com/nats-io/nkeys/pull/54
• [FEAT] Made decode a little fast by @​nanjj in https://github.com/nats-io/nkeys/pull/55
• [REPO] Add issue forms by @​bruth in https://github.com/nats-io/nkeys/pull/56
• [FIX] added binaries to match nats-server by @​aricart in https://github.com/nats-io/nkeys/pull/58

Full Changelog: nats-io/nkeys@v0.4.4...v0.4.5

---

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate. View repository job log here.