NomadGHSA-rpvr-38xv-xvxq

Nomad ACL Policies without Label are Applied to Unexpected Resources

CVE-2023-3072 · Published Jul 20, 2023 · updated Sep 26, 2024

Medium4.1

Fix: upgrade to 1.4.11 or later (2 fixed versions below)

A vulnerability was identified in Nomad, an ACL policy using a block without label may be applied to unexpected resources. This vulnerability, CVE-2023-3072, affects Nomad from 0.7 up to 1.5.6 and 1.4.10 and was fixed in 1.6.0, 1.5.7, and 1.4.11.

Affected versions

Package	Affected	Fixed in
github.com/hashicorp/nomad Go	>= 0.7.0, < 1.4.11	1.4.11
	>= 1.5.0, < 1.5.6	1.5.6

Details and references

CVSS 3.1: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:L
Severity from: GitHub (reviewed advisory)
Weakness: CWE-266, CWE-862
Also known as: CVE-2023-3072, GO-2024-2670

More Nomad advisories

All Nomad

Medium 5.3Jul 20, 2023

Nomad Search API Leaks Information About CSI PluginsCVE-2023-3300fixed in 1.4.11 +1 Low 3.4Jul 20, 2023

Nomad Caller ACL Token’s Secret ID is Exposed to SentinelCVE-2023-3299fixed in 1.4.11 +1 Medium 5.3Jul 6, 2023

Hashicorp Nomad ACLs Cannot Deny Access to Workload’s Own VariablesCVE-2023-1296fixed in 1.4.6 +1 High 8.8Apr 5, 2023

HashiCorp Nomad vulnerable to unauthenticated client agent HTTP request privilege escalationCVE-2023-1782fixed in 1.5.3 High 8.8Mar 14, 2023

Nomad Job Submitter Privilege Escalation Using Workload IdentityCVE-2023-1299fixed in 1.5.1 Medium 6.5Feb 17, 2023

Uncontrolled Resource Consumption in Hashicorp NomadCVE-2023-0821fixed in 1.2.16 +2