Advisoriesby IbisNomadGHSA-526x-rm7j-v389
Privilege escalation in Hashicorp Nomad
Fix: upgrade to 1.1.14 or later (3 fixed versions below)
HashiCorp Nomad and Nomad Enterprise version 0.2.0 up to 1.3.0 were impacted by go-getter vulnerabilities enabling privilege escalation through the artifact stanza in submitted jobs onto the client agent host. Fixed in 1.1.14, 1.2.8, and 1.3.1.
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| github.com/hashicorp/nomad Go | >= 0.2.0, < 1.1.14 | 1.1.14 |
| >= 1.2.0, < 1.2.8 | 1.2.8 | |
| >= 1.3.0, < 1.3.1 | 1.3.1 |
Details and references
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Severity from
- GitHub (reviewed advisory)
- Also known as
- CVE-2022-30324, GO-2022-0732
More Nomad advisories
All Nomad
Hashicorp Nomad Access Control IssuesCVE-2019-12618fixed in 0.9.2HashiCorp Nomad vulnerable to Allocation of Resources Without Limits or ThrottlingCVE-2022-24685fixed in 1.0.17 +2Arbitrary file reads in HashiCorp NomadCVE-2022-24683fixed in 1.0.18 +2Nomad Spread Job Stanza May Trigger Panic in ServersCVE-2022-24684fixed in 1.0.18 +2Path Traversal in HashiCorp NomadCVE-2020-28348fixed in 0.10.8 +2Hashicorp Nomad Information Exposure Through Environmental VariablesCVE-2019-14802fixed in 0.9.5