AI and data stack advisories

Severe, 6 weeks1498Projects326

1498 severe, 6 weeks · 326 projects

NomadGHSA-9jfx-84v9-2rr2

Nomad Caller ACL Token’s Secret ID is Exposed to Sentinel

Nomad

CVE-2023-3299 · Published Jul 20, 2023 · updated Sep 26, 2024

Low3.4
Fix: upgrade to 1.4.11 or later (2 fixed versions below)
GitHub advisory

A vulnerability was identified in Nomad such that the API caller’s ACL token secret ID is exposed to Sentinel policies. This vulnerability, CVE-2023-3299, affects Nomad from 1.2.11 up to 1.5.6, and 1.4.10 and was fixed in 1.6.0, 1.5.7, and 1.4.11.

Affected versions

PackageAffectedFixed in
github.com/hashicorp/nomad
Go
>= 1.2.11, < 1.4.111.4.11
>= 1.5.0, < 1.5.71.5.7
Details and references
CVSS 3.1
CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N
Severity from
GitHub (reviewed advisory)
Weakness
CWE-201, CWE-668
Also known as
CVE-2023-3299, GO-2024-2669

More Nomad advisories

All Nomad
Medium 5.3Jul 20, 2023Nomad Search API Leaks Information About CSI PluginsCVE-2023-3300fixed in 1.4.11 +1Medium 4.1Jul 20, 2023Nomad ACL Policies without Label are Applied to Unexpected ResourcesCVE-2023-3072fixed in 1.4.11 +1Medium 5.3Jul 6, 2023Hashicorp Nomad ACLs Cannot Deny Access to Workload’s Own VariablesCVE-2023-1296fixed in 1.4.6 +1High 8.8Apr 5, 2023HashiCorp Nomad vulnerable to unauthenticated client agent HTTP request privilege escalationCVE-2023-1782fixed in 1.5.3High 8.8Mar 14, 2023Nomad Job Submitter Privilege Escalation Using Workload IdentityCVE-2023-1299fixed in 1.5.1Medium 6.5Feb 17, 2023Uncontrolled Resource Consumption in Hashicorp NomadCVE-2023-0821fixed in 1.2.16 +2