AI and data stack advisories

Severe, 6 weeks1496Projects326

1496 severe, 6 weeks · 326 projects

NomadGHSA-cj2h-ww36-v932

Improper Certificate Validation in HashiCorp Nomad

Nomad

CVE-2020-7956 · Published May 18, 2021 · updated Aug 21, 2024

High9.8
Fix: upgrade to 0.10.3 or later
GitHub advisory

HashiCorp Nomad and Nomad Enterprise up to 0.10.2 incorrectly validated role/region associated with TLS certificates used for mTLS RPC, and were susceptible to privilege escalation. Fixed in 0.10.3.

Affected versions

PackageAffectedFixed in
github.com/hashicorp/nomad
Go
< 0.10.30.10.3
Details and references
CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Severity from
GitHub (reviewed advisory)
Weakness
CWE-295
Also known as
CVE-2020-7956, GO-2022-0821

More Nomad advisories

All Nomad
Medium 5.9Feb 15, 2022HashiCorp Nomad Artifact Download Race ConditionCVE-2022-24686fixed in 1.0.18 +2High 8.8Dec 10, 2021Improper Authentication in HashiCorp NomadCVE-2021-43415fixed in 1.0.14 +2High 8.8Sep 8, 2021Privilege escalation in Hashicorp NomadCVE-2021-37218fixed in 1.0.10 +1High 7.5Jun 24, 2021Improper Privilege Management in HashiCorp NomadCVE-2021-3283fixed in 0.12.10 +1Medium 6.5Jun 24, 2021Improper network isolation in Hashicorp NomadCVE-2021-32575fixed in 0.12.12 +1High 7.5May 18, 2021Allocation of Resources Without Limits or Throttling in HashiCorp NomadCVE-2020-7218fixed in 0.10.3