AI and data stack advisories

Severe, 6 weeks1496Projects326

1496 severe, 6 weeks · 326 projects

NomadGHSA-vf6q-9f2f-mwhv

Improper network isolation in Hashicorp Nomad

Nomad

CVE-2021-32575 · Published Jun 24, 2021 · updated Aug 21, 2024

Medium6.5
Fix: upgrade to 0.12.12 or later (2 fixed versions below)
GitHub advisory

HashiCorp Nomad and Nomad Enterprise up to version 1.0.4 bridge networking mode allows ARP spoofing from other bridged tasks on the same node. Fixed in 0.12.12, 1.0.5, and 1.1.0 RC1.

Affected versions

PackageAffectedFixed in
github.com/hashicorp/nomad
Go
>= 1.0.0, < 1.0.51.0.5
< 0.12.120.12.12
Details and references
CVSS 3.1
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Severity from
GitHub (reviewed advisory)
Weakness
CWE-1100
Also known as
CVE-2021-32575, GO-2022-0709

More Nomad advisories

All Nomad
Medium 5.9Feb 15, 2022HashiCorp Nomad Artifact Download Race ConditionCVE-2022-24686fixed in 1.0.18 +2High 8.8Dec 10, 2021Improper Authentication in HashiCorp NomadCVE-2021-43415fixed in 1.0.14 +2High 8.8Sep 8, 2021Privilege escalation in Hashicorp NomadCVE-2021-37218fixed in 1.0.10 +1High 7.5Jun 24, 2021Improper Privilege Management in HashiCorp NomadCVE-2021-3283fixed in 0.12.10 +1High 9.8May 18, 2021Improper Certificate Validation in HashiCorp NomadCVE-2020-7956fixed in 0.10.3High 7.5May 18, 2021Allocation of Resources Without Limits or Throttling in HashiCorp NomadCVE-2020-7218fixed in 0.10.3