GHSA-vf6q-9f2f-mwhv

ghsaUSosv

Improper network isolation in Hashicorp Nomad

view advisory published 2021-06-24Licence: CC-BY-4.0

HashiCorp Nomad and Nomad Enterprise up to version 1.0.4 bridge networking mode allows ARP spoofing from other bridged tasks on the same node. Fixed in 0.12.12, 1.0.5, and 1.1.0 RC1.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2021-32575US	medium6.5	0.51% (43rd)	—	2021-06-17
HashiCorp Nomad and Nomad Enterprise up to version 1.0.4 bridge networking mode allows ARP spoofing from other bridged tasks on the same node. Fixed in 0.12.12, 1.0.5, and 1.1.0 RC…

references

External citations — patches, advisories, analysis.

https://discuss.hashicorp.com/t/hcsec-2021-14-nomad-bridge-networking-mode-allows-arp-spoofing-from-other-bridged-tasks-on-same-node/24296WEB
https://nvd.nist.gov/vuln/detail/CVE-2021-32575ADVISORY
https://www.hashicorp.com/blog/category/nomadWEB

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan