GitHub Advisoryadvisory · Go

GHSA-vf6q-9f2f-mwhv Improper network isolation in Hashicorp Nomad

MEDIUM Published 2021-06-24 Modified 2021-06-23 Official page ↗
Aliases
CVE-2021-32575
Ecosystem
Go
Packages
github.com/hashicorp/nomad
Severity
Moderate
CVSS vector
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Weaknesses
CWE-1100
Reviewed
2021-06-18

Affected packages

• Go github.com/hashicorp/nomad: >= 1.0.0, < 1.0.5 → fixed in 1.0.5 • Go github.com/hashicorp/nomad: < 0.12.12 → fixed in 0.12.12

Description

HashiCorp Nomad and Nomad Enterprise up to version 1.0.4 bridge networking mode allows ARP spoofing from other bridged tasks on the same node. Fixed in 0.12.12, 1.0.5, and 1.1.0 RC1.

Related

Alias · CVE (1)

  • CVE-2021-32575 HashiCorp Nomad and Nomad Enterprise up to version 1.0.4 bridge networking mode allows ARP spoofing from other bridged tasks on the same… vulnerability

Weakness · CWE (1)

  • CWE-1100 Insufficient Isolation of System-Dependent Functions weakness

References