NomadGHSA-w479-w22g-cffh

Uncontrolled Resource Consumption in Hashicorp Nomad

CVE-2023-0821 · Published Feb 17, 2023 · updated Aug 20, 2024

Medium6.5

Fix: upgrade to 1.2.16 or later (3 fixed versions below)

HashiCorp Nomad and Nomad Enterprise 1.2.15 up to 1.3.8, and 1.4.3 jobs using a maliciously compressed artifact stanza source can cause excessive disk usage. Fixed in 1.2.16, 1.3.9, and 1.4.4.

Affected versions

Package	Affected	Fixed in
github.com/hashicorp/nomad Go	>= 1.2.15, < 1.2.16	1.2.16
	>= 1.3.0, < 1.3.9	1.3.9
	>= 1.4.0, < 1.4.4	1.4.4

Details and references

CVSS 3.1: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Severity from: GitHub (reviewed advisory)
Weakness: CWE-400
Also known as: CVE-2023-0821, GO-2023-1581

More Nomad advisories

All Nomad

Medium 5.3Jul 6, 2023

Hashicorp Nomad ACLs Cannot Deny Access to Workload’s Own VariablesCVE-2023-1296fixed in 1.4.6 +1 High 8.8Apr 5, 2023

HashiCorp Nomad vulnerable to unauthenticated client agent HTTP request privilege escalationCVE-2023-1782fixed in 1.5.3 High 8.8Mar 14, 2023

Nomad Job Submitter Privilege Escalation Using Workload IdentityCVE-2023-1299fixed in 1.5.1 Medium 5.0Nov 10, 2022

HashiCorp Nomad vulnerable to non-sensitive metadata exposureCVE-2022-3866fixed in 1.4.2 Low 2.7Nov 10, 2022

HashiCorp Nomad vulnerable to Insufficient Session ExpirationCVE-2022-3867fixed in 1.4.2 Medium 6.5Oct 12, 2022

Nomad Panics On Job Submission With Bad Artifact Stanza Source URLCVE-2022-41606fixed in 1.2.13 +1