Advisoriesby IbisNomadGHSA-3382-r9q8-4hfg
HashiCorp Nomad vulnerable to Allocation of Resources Without Limits or Throttling
Fix: upgrade to 1.0.17 or later (3 fixed versions below)
HashiCorp Nomad and Nomad Enterprise 1.x before 1.0.17, 1.1.x before 1.1.12, and 1.2.x before 1.2.6 is vulnerable to Allocation of Resources Without Limits or Throttling.
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| github.com/hashicorp/nomad Go | >= 1.0.0, < 1.0.17 | 1.0.17 |
| >= 1.1.0, < 1.1.12 | 1.1.12 | |
| >= 1.2.0, < 1.2.6 | 1.2.6 |
Details and references
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- Severity from
- GitHub (reviewed advisory)
- Weakness
- CWE-770
- Also known as
- CVE-2022-24685, GO-2022-0577
- nvd.nist.gov/vuln/detail/CVE-2022-24685
- discuss.hashicorp.com
- discuss.hashicorp.com/t/hcsec-2022-03-nomad-malformed-job-parsing-results-in-excessive-cpu-usage
- discuss.hashicorp.com/t/hcsec-2022-03-nomad-malformed-job-parsing-results-in-excessive-cpu-usage/35561
- security.netapp.com/advisory/ntap-20220331-0007
- github.com/hashicorp/nomad
More Nomad advisories
All Nomad
Arbitrary file reads in HashiCorp NomadCVE-2022-24683fixed in 1.0.18 +2Nomad Spread Job Stanza May Trigger Panic in ServersCVE-2022-24684fixed in 1.0.18 +2Path Traversal in HashiCorp NomadCVE-2020-28348fixed in 0.10.8 +2Hashicorp Nomad Information Exposure Through Environmental VariablesCVE-2019-14802fixed in 0.9.5Use After Free in HashiCorp NomadCVE-2020-27195fixed in 0.10.6 +2HashiCorp Nomad Artifact Download Race ConditionCVE-2022-24686fixed in 1.0.18 +2