GitHub Advisoryadvisory · Go

GHSA-9jfx-84v9-2rr2 Nomad Caller ACL Token’s Secret ID is Exposed to Sentinel

LOW Published 2023-07-20 Modified 2024-09-26 Official page ↗
Aliases
CVE-2023-3299
Ecosystem
Go
Packages
github.com/hashicorp/nomad
Severity
Low
CVSS vector
CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N
Weaknesses
CWE-201, CWE-668
Reviewed
2024-04-01

Affected packages

• Go github.com/hashicorp/nomad: >= 1.2.11, < 1.4.11 → fixed in 1.4.11 • Go github.com/hashicorp/nomad: >= 1.5.0, < 1.5.7 → fixed in 1.5.7

Description

A vulnerability was identified in Nomad such that the API caller’s ACL token secret ID is exposed to Sentinel policies. This vulnerability, CVE-2023-3299, affects Nomad from 1.2.11 up to 1.5.6, and 1.4.10 and was fixed in 1.6.0, 1.5.7, and 1.4.11.

Related

Alias · CVE (1)

  • CVE-2023-3299 HashiCorp Nomad Enterprise 1.2.11 up to 1.5.6, and 1.4.10 ACL policies using a block without a label generates unexpected results. vulnerability

Weakness · CWE (2)

  • CWE-201 Insertion of Sensitive Information Into Sent Data weakness
  • CWE-668 Exposure of Resource to Wrong Sphere weakness

References