GHSA-526x-rm7j-v389

ghsaUSosv

Privilege escalation in Hashicorp Nomad

view advisory published 2022-06-03Licence: CC-BY-4.0

HashiCorp Nomad and Nomad Enterprise version 0.2.0 up to 1.3.0 were impacted by go-getter vulnerabilities enabling privilege escalation through the artifact stanza in submitted jobs onto the client agent host. Fixed in 1.1.14, 1.2.8, and 1.3.1.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2022-30324US	critical9.8	1.42% (73rd)	—	2022-06-02
HashiCorp Nomad and Nomad Enterprise version 0.2.0 up to 1.3.0 were impacted by go-getter vulnerabilities enabling privilege escalation through the artifact stanza in submitted job…

references

External citations — patches, advisories, analysis.

https://discuss.hashicorp.comWEB
https://discuss.hashicorp.com/t/hcsec-2022-14-nomad-impacted-by-go-getter-vulnerabilities/39932WEB
https://github.com/hashicorp/nomadPACKAGE
https://nvd.nist.gov/vuln/detail/CVE-2022-30324ADVISORY

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan