NomadGHSA-v5fm-hr72-27hx
Nomad Search API Leaks Information About CSI Plugins
Medium5.3CVE-2023-3300 · Published Jul 20, 2023 · updated Apr 5, 2024
A vulnerability was identified in Nomad such that the search HTTP API can reveal names of available CSI plugins to unauthenticated users or users without the plugin:read policy. This vulnerability, CVE-2023-3300, affects Nomad since 0.11 and was fixed in 1.6.0, 1.5.7, and 1.4.11.
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| github.com/hashicorp/nomad Go | >= 0.11.0, < 1.4.11 | 1.4.11 |
| >= 1.5.0, < 1.5.7 | 1.5.7 |
Details and references
More Nomad advisories
All Nomad| Date | Advisory | Severity | Fixed in |
|---|---|---|---|
| Jul 202023 | Nomad Caller ACL Token’s Secret ID is Exposed to Sentinel Low3.4Jul 20, 2023 | Low3.4 | 1.4.11+1 more |
| Jul 202023 | Nomad ACL Policies without Label are Applied to Unexpected ResourcesMedium4.1Jul 20, 2023 | Medium4.1 | 1.4.11+1 more |
| Jul 62023 | Hashicorp Nomad ACLs Cannot Deny Access to Workload’s Own VariablesMedium5.3Jul 6, 2023 | Medium5.3 | 1.4.6+1 more |
| Apr 52023 | HashiCorp Nomad vulnerable to unauthenticated client agent HTTP request privilege escalationHigh8.8Apr 5, 2023 | High8.8 | 1.5.3 |
| Mar 142023 | Nomad Job Submitter Privilege Escalation Using Workload IdentityHigh8.8Mar 14, 2023 | High8.8 | 1.5.1 |
| Feb 172023 | Uncontrolled Resource Consumption in Hashicorp NomadMedium6.5Feb 17, 2023 | Medium6.5 | 1.2.16+2 more |