NomadGHSA-c8x3-rg72-fwwg
Privilege escalation in Hashicorp Nomad
High8.8CVE-2021-37218 · Published Sep 8, 2021 · updated Aug 21, 2024
HashiCorp Nomad and Nomad Enterprise Raft RPC layer allows non-server agents with a valid certificate signed by the same CA to access server-only functionality, enabling privilege escalation. Fixed in 1.0.10 and 1.1.4.
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| github.com/hashicorp/nomad Go | < 1.0.10 | 1.0.10 |
| >= 1.1.0, < 1.1.4 | 1.1.4 |
Details and references
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Severity from
- GitHub (reviewed advisory)
- Weakness
- CWE-295
- Also known as
- CVE-2021-37218, GO-2022-0591
More Nomad advisories
All Nomad| Date | Advisory | Severity | Fixed in |
|---|---|---|---|
| Feb 152022 | HashiCorp Nomad Artifact Download Race Condition Medium5.9Feb 15, 2022 | Medium5.9 | 1.0.18+2 more |
| Dec 102021 | Improper Authentication in HashiCorp NomadHigh8.8Dec 10, 2021 | High8.8 | 1.0.14+2 more |
| Jun 242021 | Improper Privilege Management in HashiCorp NomadHigh7.5Jun 24, 2021 | High7.5 | 0.12.10+1 more |
| Jun 242021 | Improper network isolation in Hashicorp NomadMedium6.5Jun 24, 2021 | Medium6.5 | 0.12.12+1 more |
| May 182021 | Improper Certificate Validation in HashiCorp NomadHigh9.8May 18, 2021 | High9.8 | 0.10.3 |
| May 182021 | Allocation of Resources Without Limits or Throttling in HashiCorp NomadHigh7.5May 18, 2021 | High7.5 | 0.10.3 |