AI and data stack advisories

Severe, 6 weeks1496Projects326

1496 severe, 6 weeks · 326 projects

NomadGHSA-2w2v-xcr9-mj4m

Hashicorp Nomad Access Control Issues

Nomad

CVE-2019-12618 · Published May 24, 2022 · updated Aug 20, 2024

Critical9.8
Fix: upgrade to 0.9.2 or later
GitHub advisory

HashiCorp Nomad 0.9.0 through 0.9.1 has Incorrect Access Control via the exec driver.

Affected versions

PackageAffectedFixed in
github.com/hashicorp/nomad
Go
>= 0.9.0, < 0.9.20.9.2
Details and references
CVSS 3.0
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Severity from
GitHub (reviewed advisory)
Weakness
CWE-269
Also known as
CVE-2019-12618, GO-2023-1928

More Nomad advisories

All Nomad
Critical 9.8Jun 3, 2022Privilege escalation in Hashicorp NomadCVE-2022-30324fixed in 1.1.14 +2High 7.5Mar 1, 2022HashiCorp Nomad vulnerable to Allocation of Resources Without Limits or ThrottlingCVE-2022-24685fixed in 1.0.17 +2High 7.5Feb 18, 2022Arbitrary file reads in HashiCorp NomadCVE-2022-24683fixed in 1.0.18 +2Medium 6.5Feb 16, 2022Nomad Spread Job Stanza May Trigger Panic in ServersCVE-2022-24684fixed in 1.0.18 +2Medium 6.5Feb 15, 2022Path Traversal in HashiCorp NomadCVE-2020-28348fixed in 0.10.8 +2Medium 5.3Feb 15, 2022Hashicorp Nomad Information Exposure Through Environmental VariablesCVE-2019-14802fixed in 0.9.5