Use After Free in HashiCorp Nomad
HashiCorp Nomad and Nomad Enterprise version 0.9.0 up to 0.12.5 client file sandbox feature can be subverted using either the template or artifact stanzas. Fixed in 0.12.6, 0.11.5, and 0.10.6
01
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2020-27195US | critical9.1 | — | ||
HashiCorp Nomad and Nomad Enterprise version 0.9.0 up to 0.12.5 client file sandbox feature can be subverted using either the template or artifact stanzas. Fixed in 0.12.6, 0.11.5,… | ||||
02
references
External citations — patches, advisories, analysis.
- https://github.com/hashicorp/nomad/blob/master/CHANGELOG.md#0126-october-21-2020WEB
- https://github.com/hashicorp/nomad/issues/9129WEB
- https://github.com/hashicorp/nomad/pull/9139WEB
- https://nvd.nist.gov/vuln/detail/CVE-2020-27195ADVISORY
- https://pkg.go.dev/github.com/hashicorp/nomad/client/allocrunner/taskrunner/templatePACKAGE
- https://www.nomadproject.io/downloadsWEB
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan