GHSA-2jhh-5xm2-j4gf

ghsaUSosv

Improper Authentication in HashiCorp Nomad

view advisory published 2021-12-10Licence: CC-BY-4.0

HashiCorp Nomad and Nomad Enterprise up to 1.0.13, 1.1.7, and 1.2.0, with the QEMU task driver enabled, allowed authenticated users with job submission capabilities to bypass the configured allowed image paths. Fixed in 1.0.14, 1.1.8, and 1.2.1.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2021-43415US	high8.8	1.22% (68th)	—	2021-12-03
HashiCorp Nomad and Nomad Enterprise up to 1.0.13, 1.1.7, and 1.2.0, with the QEMU task driver enabled, allowed authenticated users with job submission capabilities to bypass the c…

references

External citations — patches, advisories, analysis.

https://discuss.hashicorp.com/t/hcsec-2021-31-nomad-qemu-task-driver-allowed-paths-bypass-with-job-args/32288WEB
https://github.com/hashicorp/nomadPACKAGE
https://nvd.nist.gov/vuln/detail/CVE-2021-43415ADVISORY
https://www.hashicorp.com/blog/category/nomadWEB

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan