AI and data stack advisories

Severe, 6 weeks1496Projects326

1496 severe, 6 weeks · 326 projects

NomadGHSA-h43v-26r7-7j4c

Allocation of Resources Without Limits or Throttling in HashiCorp Nomad

Nomad

CVE-2020-7218 · Published May 18, 2021 · updated Aug 21, 2024

High7.5
Fix: upgrade to 0.10.3 or later
GitHub advisory

HashiCorp Nomad and Nomad Enterprise before 0.10.3 allow unbounded resource usage.

Specific Go Packages Affected

github.com/hashicorp/nomad/command/agent

Affected versions

PackageAffectedFixed in
github.com/hashicorp/nomad
Go
< 0.10.30.10.3
Details and references
CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Severity from
GitHub (reviewed advisory)
Weakness
CWE-400, CWE-770
Also known as
CVE-2020-7218, GO-2022-0840

More Nomad advisories

All Nomad
Medium 5.9Feb 15, 2022HashiCorp Nomad Artifact Download Race ConditionCVE-2022-24686fixed in 1.0.18 +2High 8.8Dec 10, 2021Improper Authentication in HashiCorp NomadCVE-2021-43415fixed in 1.0.14 +2High 8.8Sep 8, 2021Privilege escalation in Hashicorp NomadCVE-2021-37218fixed in 1.0.10 +1High 7.5Jun 24, 2021Improper Privilege Management in HashiCorp NomadCVE-2021-3283fixed in 0.12.10 +1Medium 6.5Jun 24, 2021Improper network isolation in Hashicorp NomadCVE-2021-32575fixed in 0.12.12 +1High 9.8May 18, 2021Improper Certificate Validation in HashiCorp NomadCVE-2020-7956fixed in 0.10.3