Advisoriesby IbisNomadGHSA-hhvx-8755-4cvw
Hashicorp Nomad ACLs Cannot Deny Access to Workload’s Own Variables
Fix: upgrade to 1.4.6 or later (2 fixed versions below)
A vulnerability was identified in Nomad and Nomad Enterprise (“Nomad”) such that a deny ACL capability could not be applied to a workload’s own variables. If included, the Nomad ACL system will silently fail to block access. This vulnerability, CVE-2023-1296, was fixed in Nomad 1.4.6 and 1.5.1.
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| github.com/hashicorp/nomad Go | >= 1.4.0, < 1.4.6 | 1.4.6 |
| >= 1.5.0, < 1.5.1 | 1.5.1 |
Details and references
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- Severity from
- GitHub (reviewed advisory)
- Also known as
- CVE-2023-1296, GO-2023-1899
More Nomad advisories
All Nomad
Nomad Search API Leaks Information About CSI PluginsCVE-2023-3300fixed in 1.4.11 +1Nomad ACL Policies without Label are Applied to Unexpected ResourcesCVE-2023-3072fixed in 1.4.11 +1Nomad Caller ACL Token’s Secret ID is Exposed to SentinelCVE-2023-3299fixed in 1.4.11 +1HashiCorp Nomad vulnerable to unauthenticated client agent HTTP request privilege escalationCVE-2023-1782fixed in 1.5.3Nomad Job Submitter Privilege Escalation Using Workload IdentityCVE-2023-1299fixed in 1.5.1Uncontrolled Resource Consumption in Hashicorp NomadCVE-2023-0821fixed in 1.2.16 +2