AI and data stack advisories

Severe, 6 weeks1498Projects326

1498 severe, 6 weeks · 326 projects

NomadGHSA-77cr-6gr8-7rr9

Use After Free in HashiCorp Nomad

Nomad

CVE-2020-27195 · Published Feb 15, 2022 · updated Aug 21, 2024

Critical9.1
Fix: upgrade to 0.10.6 or later (3 fixed versions below)
GitHub advisory

HashiCorp Nomad and Nomad Enterprise version 0.9.0 up to 0.12.5 client file sandbox feature can be subverted using either the template or artifact stanzas. Fixed in 0.12.6, 0.11.5, and 0.10.6

Affected versions

PackageAffectedFixed in
github.com/hashicorp/nomad
Go
>= 0.9.0, < 0.10.60.10.6
>= 0.11.0, < 0.11.50.11.5
>= 0.12.0, < 0.12.60.12.6
Details and references
CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Severity from
GitHub (reviewed advisory)
Weakness
CWE-416
Also known as
CVE-2020-27195, GO-2022-0806

More Nomad advisories

All Nomad
High 7.5Mar 1, 2022HashiCorp Nomad vulnerable to Allocation of Resources Without Limits or ThrottlingCVE-2022-24685fixed in 1.0.17 +2High 7.5Feb 18, 2022Arbitrary file reads in HashiCorp NomadCVE-2022-24683fixed in 1.0.18 +2Medium 6.5Feb 16, 2022Nomad Spread Job Stanza May Trigger Panic in ServersCVE-2022-24684fixed in 1.0.18 +2Medium 6.5Feb 15, 2022Path Traversal in HashiCorp NomadCVE-2020-28348fixed in 0.10.8 +2Medium 5.3Feb 15, 2022Hashicorp Nomad Information Exposure Through Environmental VariablesCVE-2019-14802fixed in 0.9.5Medium 5.9Feb 15, 2022HashiCorp Nomad Artifact Download Race ConditionCVE-2022-24686fixed in 1.0.18 +2