NomadGHSA-v5fm-hr72-27hx

Nomad Search API Leaks Information About CSI Plugins

CVE-2023-3300 · Published Jul 20, 2023 · updated Apr 5, 2024

Medium5.3

Fix: upgrade to 1.4.11 or later (2 fixed versions below)

A vulnerability was identified in Nomad such that the search HTTP API can reveal names of available CSI plugins to unauthenticated users or users without the plugin:read policy. This vulnerability, CVE-2023-3300, affects Nomad since 0.11 and was fixed in 1.6.0, 1.5.7, and 1.4.11.

Affected versions

Package	Affected	Fixed in
github.com/hashicorp/nomad Go	>= 0.11.0, < 1.4.11	1.4.11
	>= 1.5.0, < 1.5.7	1.5.7

Details and references

CVSS 3.1: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Severity from: GitHub (reviewed advisory)
Weakness: CWE-266, CWE-862
Also known as: CVE-2023-3300, GO-2024-2671

More Nomad advisories

All Nomad

Low 3.4Jul 20, 2023

Nomad Caller ACL Token’s Secret ID is Exposed to SentinelCVE-2023-3299fixed in 1.4.11 +1 Medium 4.1Jul 20, 2023

Nomad ACL Policies without Label are Applied to Unexpected ResourcesCVE-2023-3072fixed in 1.4.11 +1 Medium 5.3Jul 6, 2023

Hashicorp Nomad ACLs Cannot Deny Access to Workload’s Own VariablesCVE-2023-1296fixed in 1.4.6 +1 High 8.8Apr 5, 2023

HashiCorp Nomad vulnerable to unauthenticated client agent HTTP request privilege escalationCVE-2023-1782fixed in 1.5.3 High 8.8Mar 14, 2023

Nomad Job Submitter Privilege Escalation Using Workload IdentityCVE-2023-1299fixed in 1.5.1 Medium 6.5Feb 17, 2023

Uncontrolled Resource Consumption in Hashicorp NomadCVE-2023-0821fixed in 1.2.16 +2