GitHub Advisoryadvisory · Go

GHSA-2jhh-5xm2-j4gf Improper Authentication in HashiCorp Nomad

HIGH Published 2021-12-10 Modified 2021-12-06 Official page ↗
Aliases
CVE-2021-43415
Ecosystem
Go
Packages
github.com/hashicorp/nomad
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-287
Reviewed
2021-12-06

Affected packages

• Go github.com/hashicorp/nomad: < 1.0.14 → fixed in 1.0.14 • Go github.com/hashicorp/nomad: >= 1.1.0, < 1.1.8 → fixed in 1.1.8 • Go github.com/hashicorp/nomad: >= 1.2.0, < 1.2.1 → fixed in 1.2.1

Description

HashiCorp Nomad and Nomad Enterprise up to 1.0.13, 1.1.7, and 1.2.0, with the QEMU task driver enabled, allowed authenticated users with job submission capabilities to bypass the configured allowed image paths. Fixed in 1.0.14, 1.1.8, and 1.2.1.

Related

Alias · CVE (1)

  • CVE-2021-43415 HashiCorp Nomad and Nomad Enterprise up to 1.0.13, 1.1.7, and 1.2.0, with the QEMU task driver enabled, allowed authenticated users with… vulnerability

Weakness · CWE (1)

  • CWE-287 Improper Authentication weakness

References