nomad Archives - CVE Vulnerability https://cvevulnerability.com/cve_products/nomad/ Sun, 26 Feb 2023 06:42:59 +0000 en-US hourly 1 https://wordpress.org/?v=7.0 https://cvevulnerability.com/wp-content/uploads/2023/02/cropped-Screenshot-2023-02-27-at-3.52.32-PM-32x32.png nomad Archives - CVE Vulnerability https://cvevulnerability.com/cve_products/nomad/ 32 32 CVE-2020-7218 https://cvevulnerability.com/cve_vulnerabilities/cve-2020-7218/ Sun, 26 Feb 2023 06:42:59 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2020-7218/ HashiCorp Nomad and Nonad Enterprise up to 0.10.2 HTTP/RPC services allowed unbounded resource usage, and were susceptible to unauthenticated denial of service. Fixed in 0.10.3.

The post CVE-2020-7218 appeared first on CVE Vulnerability.

]]> HashiCorp Nomad and Nonad Enterprise up to 0.10.2 HTTP/RPC services allowed unbounded resource usage, and were susceptible to unauthenticated denial of service. Fixed in 0.10.3.

The post CVE-2020-7218 appeared first on CVE Vulnerability.

]]> CVE-2020-28348 https://cvevulnerability.com/cve_vulnerabilities/cve-2020-28348/ Sun, 26 Feb 2023 06:40:38 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2020-28348/ HashiCorp Nomad and Nomad Enterprise 0.9.0 up to 0.12.7 client Docker file sandbox feature may be subverted when not explicitly disabled or when using a volume mount type. Fixed in 0.12.8, 0.11.7, and 0.10.8.

The post CVE-2020-28348 appeared first on CVE Vulnerability.

]]> HashiCorp Nomad and Nomad Enterprise 0.9.0 up to 0.12.7 client Docker file sandbox feature may be subverted when not explicitly disabled or when using a volume mount type. Fixed in 0.12.8, 0.11.7, and 0.10.8.

The post CVE-2020-28348 appeared first on CVE Vulnerability.

]]> CVE-2019-14802 https://cvevulnerability.com/cve_vulnerabilities/cve-2019-14802/ Sun, 26 Feb 2023 06:30:42 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2019-14802/ HashiCorp Nomad 0.5.0 through 0.9.4 (fixed in 0.9.5) reveals unintended environment variables to the rendering task during template rendering, aka GHSA-6hv3-7c34-4hx8. This applies to nomad/client/allocrunner/taskrunner/template.

The post CVE-2019-14802 appeared first on CVE Vulnerability.

]]> HashiCorp Nomad 0.5.0 through 0.9.4 (fixed in 0.9.5) reveals unintended environment variables to the rendering task during template rendering, aka GHSA-6hv3-7c34-4hx8. This applies to nomad/client/allocrunner/taskrunner/template.

The post CVE-2019-14802 appeared first on CVE Vulnerability.

]]> CVE-2021-43415 https://cvevulnerability.com/cve_vulnerabilities/cve-2021-43415/ Thu, 23 Feb 2023 14:12:28 +0000 http://www.cvevulnerability.com/cve_vulnerabilities/cve-2021-43415/ HashiCorp Nomad and Nomad Enterprise up to 1.0.13, 1.1.7, and 1.2.0, with the QEMU task driver enabled, allowed authenticated users with job submission capabilities to bypass the configured allowed image paths. Fixed in 1.0.14, 1.1.8, and 1.2.1.

The post CVE-2021-43415 appeared first on CVE Vulnerability.

]]> HashiCorp Nomad and Nomad Enterprise up to 1.0.13, 1.1.7, and 1.2.0, with the QEMU task driver enabled, allowed authenticated users with job submission capabilities to bypass the configured allowed image paths. Fixed in 1.0.14, 1.1.8, and 1.2.1.

The post CVE-2021-43415 appeared first on CVE Vulnerability.

]]> CVE-2021-41865 https://cvevulnerability.com/cve_vulnerabilities/cve-2021-41865/ Thu, 23 Feb 2023 14:12:07 +0000 http://www.cvevulnerability.com/cve_vulnerabilities/cve-2021-41865/ HashiCorp Nomad and Nomad Enterprise 1.1.1 through 1.1.5 allowed authenticated users with job submission capabilities to cause denial of service by submitting incomplete job specifications with a Consul mesh gateway and host networking mode. Fixed in 1.1.6.

The post CVE-2021-41865 appeared first on CVE Vulnerability.

]]> HashiCorp Nomad and Nomad Enterprise 1.1.1 through 1.1.5 allowed authenticated users with job submission capabilities to cause denial of service by submitting incomplete job specifications with a Consul mesh gateway and host networking mode. Fixed in 1.1.6.

The post CVE-2021-41865 appeared first on CVE Vulnerability.

]]> CVE-2021-37218 https://cvevulnerability.com/cve_vulnerabilities/cve-2021-37218/ Thu, 23 Feb 2023 14:10:53 +0000 http://www.cvevulnerability.com/cve_vulnerabilities/cve-2021-37218/ HashiCorp Nomad and Nomad Enterprise Raft RPC layer allows non-server agents with a valid certificate signed by the same CA to access server-only functionality, enabling privilege escalation. Fixed in 1.0.10 and 1.1.4.

The post CVE-2021-37218 appeared first on CVE Vulnerability.

]]> HashiCorp Nomad and Nomad Enterprise Raft RPC layer allows non-server agents with a valid certificate signed by the same CA to access server-only functionality, enabling privilege escalation. Fixed in 1.0.10 and 1.1.4.

The post CVE-2021-37218 appeared first on CVE Vulnerability.

]]> CVE-2021-3283 https://cvevulnerability.com/cve_vulnerabilities/cve-2021-3283/ Thu, 23 Feb 2023 14:09:52 +0000 http://www.cvevulnerability.com/cve_vulnerabilities/cve-2021-3283/ HashiCorp Nomad and Nomad Enterprise up to 0.12.9 exec and java task drivers can access processes associated with other tasks on the same node. Fixed in 0.12.10, and 1.0.3.

The post CVE-2021-3283 appeared first on CVE Vulnerability.

]]> HashiCorp Nomad and Nomad Enterprise up to 0.12.9 exec and java task drivers can access processes associated with other tasks on the same node. Fixed in 0.12.10, and 1.0.3.

The post CVE-2021-3283 appeared first on CVE Vulnerability.

]]> CVE-2021-32575 https://cvevulnerability.com/cve_vulnerabilities/cve-2021-32575/ Thu, 23 Feb 2023 14:09:47 +0000 http://www.cvevulnerability.com/cve_vulnerabilities/cve-2021-32575/ HashiCorp Nomad and Nomad Enterprise up to version 1.0.4 bridge networking mode allows ARP spoofing from other bridged tasks on the same node. Fixed in 0.12.12, 1.0.5, and 1.1.0 RC1.

The post CVE-2021-32575 appeared first on CVE Vulnerability.

]]> HashiCorp Nomad and Nomad Enterprise up to version 1.0.4 bridge networking mode allows ARP spoofing from other bridged tasks on the same node. Fixed in 0.12.12, 1.0.5, and 1.1.0 RC1.

The post CVE-2021-32575 appeared first on CVE Vulnerability.

]]> CVE-2022-41606 https://cvevulnerability.com/cve_vulnerabilities/cve-2022-41606/ Thu, 23 Feb 2023 05:20:49 +0000 http://www.cvevulnerability.com/cve_vulnerabilities/cve-2022-41606/ HashiCorp Nomad and Nomad Enterprise 1.0.2 up to 1.2.12, and 1.3.5 jobs submitted with an artifact stanza using invalid S3 or GCS URLs can be used to crash client agents. Fixed in 1.2.13, 1.3.6, and 1.4.0.

The post CVE-2022-41606 appeared first on CVE Vulnerability.

]]> HashiCorp Nomad and Nomad Enterprise 1.0.2 up to 1.2.12, and 1.3.5 jobs submitted with an artifact stanza using invalid S3 or GCS URLs can be used to crash client agents. Fixed in 1.2.13, 1.3.6, and 1.4.0.

The post CVE-2022-41606 appeared first on CVE Vulnerability.

]]> CVE-2022-3866 https://cvevulnerability.com/cve_vulnerabilities/cve-2022-3866/ Thu, 23 Feb 2023 05:20:16 +0000 http://www.cvevulnerability.com/cve_vulnerabilities/cve-2022-3866/ HashiCorp Nomad and Nomad Enterprise 1.4.0 up to 1.4.1 workload identity token can list non-sensitive metadata for paths under nomad/ that belong to other jobs in the same namespace. Fixed in 1.4.2.

The post CVE-2022-3866 appeared first on CVE Vulnerability.

]]> HashiCorp Nomad and Nomad Enterprise 1.4.0 up to 1.4.1 workload identity token can list non-sensitive metadata for paths under nomad/ that belong to other jobs in the same namespace. Fixed in 1.4.2.

The post CVE-2022-3866 appeared first on CVE Vulnerability.

]]>