GitHub Advisoryadvisory · Go

GHSA-c866-8gpw-p3mv HashiCorp Nomad vulnerable to symlink attacks

HIGH Published 2024-02-08 Modified 2024-09-26 Official page ↗
Aliases
CVE-2024-1329
Ecosystem
Go
Packages
github.com/hashicorp/nomad
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:N/I:H/A:H
Weaknesses
CWE-59, CWE-610
Reviewed
2024-02-09

Affected packages

• Go github.com/hashicorp/nomad: >= 1.5.13, < 1.5.14 → fixed in 1.5.14 • Go github.com/hashicorp/nomad: >= 1.6.0, < 1.6.7 → fixed in 1.6.7 • Go github.com/hashicorp/nomad: >= 1.7.3, < 1.7.4 → fixed in 1.7.4

Description

HashiCorp Nomad and Nomad Enterprise 1.5.13 up to 1.6.6, and 1.7.3 template renderer is vulnerable to arbitrary file write on the host as the Nomad client user through symlink attacks. Fixed in Nomad 1.7.4, 1.6.7, 1.5.14.

Related

Alias · CVE (1)

  • CVE-2024-1329 HashiCorp Nomad and Nomad Enterprise 1.5.13 up to 1.6.6, and 1.7.3 template renderer is vulnerable to arbitrary file write on the host as… vulnerability

Weakness · CWE (2)

  • CWE-59 Improper Link Resolution Before File Access weakness
  • CWE-610 Externally Controlled Reference to a Resource in Another Sphere weakness

References