GitHub Advisoryadvisory · Go

GHSA-5x92-p4p5-33c4 Path Traversal in HashiCorp Nomad

MEDIUM Published 2022-02-15 Modified 2023-10-02 Official page ↗
Aliases
CVE-2020-28348
Ecosystem
Go
Packages
github.com/hashicorp/nomad
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-22
Reviewed
2021-05-12

Affected packages

• Go github.com/hashicorp/nomad: >= 0.9.0, < 0.10.8 → fixed in 0.10.8 • Go github.com/hashicorp/nomad: >= 0.11.0-beta1, < 0.11.7 → fixed in 0.11.7 • Go github.com/hashicorp/nomad: >= 0.12.0-beta1, < 0.12.8 → fixed in 0.12.8

Description

HashiCorp Nomad and Nomad Enterprise 0.9.0 up to 0.12.7 client Docker file sandbox feature (github.com/hashicorp/nomad/drivers/docker) may be subverted when not explicitly disabled or when using a volume mount type. Fixed in 0.12.8, 0.11.7, and 0.10.8.

Related

Alias · CVE (1)

  • CVE-2020-28348 HashiCorp Nomad and Nomad Enterprise 0.9.0 up to 0.12.7 client Docker file sandbox feature may be subverted when not explicitly disabled or… vulnerability

Weakness · CWE (1)

  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness

References