Advisoriesby IbisNomadGHSA-35qp-xq9f-2rjx
Improper Privilege Management in HashiCorp Nomad
Fix: upgrade to 0.12.10 or later (2 fixed versions below)
HashiCorp Nomad and Nomad Enterprise up to 0.12.9 exec and java task drivers can access processes associated with other tasks on the same node. Fixed in 0.12.10, and 1.0.3.
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| github.com/hashicorp/nomad Go | >= 1.0.0, < 1.0.3 | 1.0.3 |
| < 0.12.10 | 0.12.10 |
Details and references
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- Severity from
- GitHub (reviewed advisory)
- Weakness
- CWE-269
- Also known as
- CVE-2021-3283, GO-2022-0622
More Nomad advisories
All Nomad
HashiCorp Nomad Artifact Download Race ConditionCVE-2022-24686fixed in 1.0.18 +2Improper Authentication in HashiCorp NomadCVE-2021-43415fixed in 1.0.14 +2Privilege escalation in Hashicorp NomadCVE-2021-37218fixed in 1.0.10 +1Improper network isolation in Hashicorp NomadCVE-2021-32575fixed in 0.12.12 +1Improper Certificate Validation in HashiCorp NomadCVE-2020-7956fixed in 0.10.3Allocation of Resources Without Limits or Throttling in HashiCorp NomadCVE-2020-7218fixed in 0.10.3