Advisoriesby IbisNomadGHSA-wmrx-57hm-mw7r
Arbitrary file reads in HashiCorp Nomad
Fix: upgrade to 1.0.18 or later (3 fixed versions below)
Nomad is an easy-to-use, flexible, and performant workload orchestrator that can deploy a mix of microservice, batch, containerized, and non-containerized applications. HashiCorp Nomad and Nomad Enterprise 0.9.2 through 1.0.17, 1.1.11, and 1.2.5 allow operators with read-fs and alloc-exec (or job-submit) capabilities to read arbitrary files on the host filesystem as root. There are currently no known workarounds. Users are recommended to upgrade as soon as possible to avoid this issue.
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| github.com/hashicorp/nomad Go | >= 0.9.2, < 1.0.18 | 1.0.18 |
| >= 1.1.0, < 1.1.12 | 1.1.12 | |
| >= 1.2.0, < 1.2.6 | 1.2.6 |
Details and references
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- Severity from
- GitHub (reviewed advisory)
- Weakness
- CWE-22
- Also known as
- CVE-2022-24683, GO-2022-0584
- nvd.nist.gov/vuln/detail/CVE-2022-24683
- github.com/hashicorp/nomad/commit/1aa46c3796e924b72eb45a7f02dae32df0c1179c
- github.com/hashicorp/nomad/commit/b3c0e6a7a53d624003698b48b6c59739552c3721
- github.com/hashicorp/nomad/commit/fcb3a5d016a3dfcc63efcdb567373735a0703279
- discuss.hashicorp.com
- discuss.hashicorp.com/t/hcsec-2022-02-nomad-alloc-filesystem-and-container-escape/35560
- security.netapp.com/advisory/ntap-20220318-0008
- github.com/hashicorp/nomad
More Nomad advisories
All Nomad
HashiCorp Nomad vulnerable to Allocation of Resources Without Limits or ThrottlingCVE-2022-24685fixed in 1.0.17 +2Nomad Spread Job Stanza May Trigger Panic in ServersCVE-2022-24684fixed in 1.0.18 +2Path Traversal in HashiCorp NomadCVE-2020-28348fixed in 0.10.8 +2Hashicorp Nomad Information Exposure Through Environmental VariablesCVE-2019-14802fixed in 0.9.5Use After Free in HashiCorp NomadCVE-2020-27195fixed in 0.10.6 +2HashiCorp Nomad Artifact Download Race ConditionCVE-2022-24686fixed in 1.0.18 +2