GHSA-w479-w22g-cffh

ghsaUSosv

Uncontrolled Resource Consumption in Hashicorp Nomad

view advisory published 2023-02-17Licence: CC-BY-4.0

HashiCorp Nomad and Nomad Enterprise 1.2.15 up to 1.3.8, and 1.4.3 jobs using a maliciously compressed artifact stanza source can cause excessive disk usage. Fixed in 1.2.16, 1.3.9, and 1.4.4.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2023-0821US	medium6.5	0.80% (56th)	—	2023-02-16
HashiCorp Nomad and Nomad Enterprise 1.2.15 up to 1.3.8, and 1.4.3 jobs using a maliciously compressed artifact stanza source can cause excessive disk usage. Fixed in 1.2.16, 1.3.9…

references

External citations — patches, advisories, analysis.

https://discuss.hashicorp.com/t/hcsec-2023-05-nomad-client-vulnerable-to-decompression-bombs-in-artifact-block/50292WEB
https://nvd.nist.gov/vuln/detail/CVE-2023-0821ADVISORY

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan