GitHub Advisoryadvisory · Go

GHSA-wmrx-57hm-mw7r Arbitrary file reads in HashiCorp Nomad

HIGH Published 2022-02-18 Modified 2022-03-24 Official page ↗
Aliases
CVE-2022-24683
Ecosystem
Go
Packages
github.com/hashicorp/nomad
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-22
Reviewed
2022-03-01

Affected packages

• Go github.com/hashicorp/nomad: >= 0.9.2, < 1.0.18 → fixed in 1.0.18 • Go github.com/hashicorp/nomad: >= 1.1.0, < 1.1.12 → fixed in 1.1.12 • Go github.com/hashicorp/nomad: >= 1.2.0, < 1.2.6 → fixed in 1.2.6

Description

Nomad is an easy-to-use, flexible, and performant workload orchestrator that can deploy a mix of microservice, batch, containerized, and non-containerized applications. HashiCorp Nomad and Nomad Enterprise 0.9.2 through 1.0.17, 1.1.11, and 1.2.5 allow operators with read-fs and alloc-exec (or job-submit) capabilities to read arbitrary files on the host filesystem as root. There are currently no known workarounds. Users are recommended to upgrade as soon as possible to avoid this issue.

Related

Alias · CVE (1)

  • CVE-2022-24683 HashiCorp Nomad and Nomad Enterprise 0.9.2 through 1.0.17, 1.1.11, and 1.2.5 allow operators with read-fs and alloc-exec (or job-submit)… vulnerability

Weakness · CWE (1)

  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness

References