GitHub Advisoryadvisory · Go

GHSA-35qp-xq9f-2rjx Improper Privilege Management in HashiCorp Nomad

HIGH Published 2021-06-24 Modified 2021-05-12 Official page ↗
Aliases
CVE-2021-3283
Ecosystem
Go
Packages
github.com/hashicorp/nomad
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-269
Reviewed
2021-05-12

Affected packages

• Go github.com/hashicorp/nomad: >= 1.0.0, < 1.0.3 → fixed in 1.0.3 • Go github.com/hashicorp/nomad: < 0.12.10 → fixed in 0.12.10

Description

HashiCorp Nomad and Nomad Enterprise up to 0.12.9 exec and java task drivers can access processes associated with other tasks on the same node. Fixed in 0.12.10, and 1.0.3.

Related

Alias · CVE (1)

  • CVE-2021-3283 HashiCorp Nomad and Nomad Enterprise up to 0.12.9 exec and java task drivers can access processes associated with other tasks on the same… vulnerability

Weakness · CWE (1)

  • CWE-269 Improper Privilege Management weakness

References