Lucene search

GitHub Advisory DatabaseGHSA-7WG4-8M5P-HRFG

HistoryNov 10, 2022 - 12:01 p.m.

HashiCorp Nomad vulnerable to non-sensitive metadata exposure

2022-11-1012:01:03

CWE-668

GitHub Advisory Database

github.com

hashicorp nomad

vulnerability

metadata exposure

1.4.0

1.4.1

1.4.2

software

5 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N

0.001 Low

EPSS

Percentile

22.9%

JSON

HashiCorp Nomad and Nomad Enterprise 1.4.0 up to 1.4.1 workload identity token can list non-sensitive metadata for paths under nomad/ that belong to other jobs in the same namespace. Fixed in 1.4.2.

Affected configurations

Vulners

Node

hashicorpnomadRange<1.4.2

CPENameOperatorVersion
github.com/hashicorp/nomadlt1.4.2

CPE	Name	Operator	Version
	github.com/hashicorp/nomad	lt	1.4.2

References

discuss.hashicorp.com/t/hcsec-2022-25-nomad-s-workload-identity-token-can-list-non-sensitive-metadata-for-nomad-paths/46167

github.com/advisories/GHSA-7wg4-8m5p-hrfg

github.com/hashicorp/nomad/commit/3b24f26603e2b116ba324101afa8a7e3a7a769a5

nvd.nist.gov/vuln/detail/CVE-2022-3866

5 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N

0.001 Low

EPSS

Percentile

22.9%

JSON

Related for GHSA-7WG4-8M5P-HRFG