Advisoriesby IbisNomadGHSA-2jhh-5xm2-j4gf
Improper Authentication in HashiCorp Nomad
Fix: upgrade to 1.0.14 or later (3 fixed versions below)
HashiCorp Nomad and Nomad Enterprise up to 1.0.13, 1.1.7, and 1.2.0, with the QEMU task driver enabled, allowed authenticated users with job submission capabilities to bypass the configured allowed image paths. Fixed in 1.0.14, 1.1.8, and 1.2.1.
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| github.com/hashicorp/nomad Go | < 1.0.14 | 1.0.14 |
| >= 1.1.0, < 1.1.8 | 1.1.8 | |
| >= 1.2.0, < 1.2.1 | 1.2.1 |
Details and references
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Severity from
- GitHub (reviewed advisory)
- Weakness
- CWE-287
- Also known as
- CVE-2021-43415, GO-2022-0573
More Nomad advisories
All Nomad
Arbitrary file reads in HashiCorp NomadCVE-2022-24683fixed in 1.0.18 +2Nomad Spread Job Stanza May Trigger Panic in ServersCVE-2022-24684fixed in 1.0.18 +2Use After Free in HashiCorp NomadCVE-2020-27195fixed in 0.10.6 +2Hashicorp Nomad Information Exposure Through Environmental VariablesCVE-2019-14802fixed in 0.9.5Path Traversal in HashiCorp NomadCVE-2020-28348fixed in 0.10.8 +2HashiCorp Nomad Artifact Download Race ConditionCVE-2022-24686fixed in 1.0.18 +2