CVE-2021-21272

ORAS is open source software which enables a way to push OCI Artifacts to OCI Conformant registries. ORAS is both a CLI for initial testing and a Go Module. In ORAS from version 0.4.0 and before version 0.9.0, there is a "zip-slip" vulnerability. The directory support feature allows the downloade...

CVE-2021-21272 zip slip in ORAS

ORAS is open source software which enables a way to push OCI Artifacts to OCI Conformant registries. ORAS is both a CLI for initial testing and a Go Module. In ORAS from version 0.4.0 and before version 0.9.0, there is a "zip-slip" vulnerability. The directory support feature allows the downloade...

FreeBSD : nomad -- multiple vulnerabilities (618010ff-3044-11eb-8112-000c292ee6b8)

The HashiCorp team reports : - artifact: Fixed a bug where interpolation can be used in the artifact destination field to write artifact payloads outside the allocation directory. - template: Fixed a bug where interpolation can be used in the template source and destination fields to read or writ...

Nomad File Sandbox Escape via Template and Artifact Stanzas

Summary A vulnerability was identified in Nomad and Nomad Enterprise “Nomad” such that a specially crafted Nomad jobspec can be used to escape the client file sandbox configuration. This vulnerability, CVE-2020-27195, affects version 0.9.0 up to 0.12.5, and is fixed in the 0.12.6, 0.11.5, and...

Securing Containers in Google Cloud Artifact Registry with Qualys

Container software supply chain is an area of concern for security teams in large and small enterprises because developers often make use of container images from a variety of public repositories. A single insecure container image can be instantiated several times and lead to a wide, diffused...

CVE-2020-27195

HashiCorp Nomad and Nomad Enterprise version 0.9.0 up to 0.12.5 client file sandbox feature can be subverted using either the template or artifact stanzas. Fixed in 0.12.6, 0.11.5, and 0.10.6...

Sandbox Restrictions Bypass

github.com/hashicorp/nomad is vulnerable to sandbox restrictions bypass. The vulnerability exists due to interpolation that can be used in the artifact destination field to write artifact payloads outside of the allocation directory...

CVE-2020-27195

HashiCorp Nomad and Nomad Enterprise version 0.9.0 up to 0.12.5 client file sandbox feature can be subverted using either the template or artifact stanzas. Fixed in 0.12.6, 0.11.5, and 0.10.6...

CVE-2020-27195

HashiCorp Nomad and Nomad Enterprise version 0.9.0 up to 0.12.5 client file sandbox feature can be subverted using either the template or artifact stanzas. Fixed in 0.12.6, 0.11.5, and 0.10.6...

CVE-2020-27195

HashiCorp Nomad and Nomad Enterprise version 0.9.0 up to 0.12.5 client file sandbox feature can be subverted using either the template or artifact stanzas. Fixed in 0.12.6, 0.11.5, and 0.10.6...

UBUNTU-CVE-2020-27195

HashiCorp Nomad and Nomad Enterprise version 0.9.0 up to 0.12.5 client file sandbox feature can be subverted using either the template or artifact stanzas. Fixed in 0.12.6, 0.11.5, and 0.10.6...

CVE-2020-27195

HashiCorp Nomad and Nomad Enterprise version 0.9.0 up to 0.12.5 client file sandbox feature can be subverted using either the template or artifact stanzas. Fixed in 0.12.6, 0.11.5, and 0.10.6...

CVE-2020-27195

HashiCorp Nomad and Nomad Enterprise version 0.9.0 up to 0.12.5 client file sandbox feature can be subverted using either the template or artifact stanzas. Fixed in 0.12.6, 0.11.5, and 0.10.6...

CVE-2020-27195

Removed by vendor...

PT-2020-16658 · Hashicorp · Nomad Enterprise +1

Name of the Vulnerable Software and Affected Versions: HashiCorp Nomad and Nomad Enterprise versions 0.9.0 through 0.12.5 Description: The client file sandbox feature in HashiCorp Nomad and Nomad Enterprise can be subverted using either the template or artifact stanzas. This issue is related to a...

nomad -- multiple vulnerabilities

The HashiCorp team reports: artifact: Fixed a bug where interpolation can be used in the artifact destination field to write artifact payloads outside the allocation directory. template: Fixed a bug where interpolation can be used in the template source and destination fields to read or write fil...

Technical Approaches to Uncovering and Remediating Malicious Activity

Summary This joint advisory is the result of a collaborative research effort by the cybersecurity authorities of five nations: Australia,1 Canada,2 New Zealand,34 the United Kingdom,5 and the United States.6 It highlights technical approaches to uncovering malicious activity and includes mitigati...

PT-2020-13415 · Gitlab · Gitlab

Name of the Vulnerable Software and Affected Versions: GitLab versions prior to 13.0.1 GitLab CE/EE affected versions not specified Description: A security issue in GitLab allowed attackers to achieve Denial of Service attacks through memory exhaustion. This was possible by uploading malicious...

Malicious Code Injection

guvnor-m2repo-editor-backend is vulnerable to malicious code injection. The attacker can inject arbitrary code by uploading a pom.xml with errors to business central using Artifact Repository as the upload function shows the error message in an HTML mode...

CloudBees Jenkins Copy Artifact Plugin Authorization Issues Vulnerability

CloudBees Jenkins Hudson Labs is the United States CloudBees company's set of Java-based development of continuous integration tools. The product is mainly used to monitor the continuous software version of the release/test project and some timed tasks . Copy Artifact Plugin is used in one of the...