UBUNTU-CVE-2023-3300

HashiCorp Nomad and Nomad Enterprise 0.11.0 up to 1.5.6 and 1.4.1 HTTP search API can reveal names of available CSI plugins to unauthenticated users or users without the plugin:read policy. Fixed in 1.6.0, 1.5.7, and 1.4.1...

CVE-2023-3300 Nomad Search API Leaks Information About CSI Plugins

HashiCorp Nomad and Nomad Enterprise 0.11.0 up to 1.5.6 and 1.4.1 HTTP search API can reveal names of available CSI plugins to unauthenticated users or users without the plugin:read policy. Fixed in 1.6.0, 1.5.7, and 1.4.1...

CVE-2023-3300 Nomad Search API Leaks Information About CSI Plugins

HashiCorp Nomad and Nomad Enterprise 0.11.0 up to 1.5.6 and 1.4.1 HTTP search API can reveal names of available CSI plugins to unauthenticated users or users without the plugin:read policy. Fixed in 1.6.0, 1.5.7, and 1.4.1...

CVE-2023-3300 Nomad Search API Leaks Information About CSI Plugins

HashiCorp Nomad and Nomad Enterprise 0.11.0 up to 1.5.6 and 1.4.1 HTTP search API can reveal names of available CSI plugins to unauthenticated users or users without the plugin:read policy. Fixed in 1.6.0, 1.5.7, and 1.4.1...

CVE-2023-3300

HashiCorp Nomad and Nomad Enterprise expose a vulnerability (CVE-2023-3300) where the HTTP search API can reveal names of available CSI plugins to unauthenticated users or those without the plugin:read policy. Affected versions are Nomad/Nomad Enterprise 0.11.0 through 1.5.6 and 1.4.1. The issue ...

CVE-2023-3300

Removed by vendor...

CVE-2023-3299 Nomad Caller ACL Token's Secret ID is Exposed to Sentinel

HashiCorp Nomad Enterprise 1.2.11 up to 1.5.6, and 1.4.10 ACL policies using a block without a label generates unexpected results. Fixed in 1.6.0, 1.5.7, and 1.4.11...

CVE-2023-3299

Removed by vendor...

CVE-2023-3299

The CVE-2023-3299 entry affects HashiCorp Nomad Enterprise 1.2.11 up to 1.5.6, and 1.4.10. The underlying issue is that ACL policies using a block without a label generate unexpected results. A fix is available in Nomad Enterprise 1.6.0, as well as 1.5.7 and 1.4.11. The provided documents do not ...

CVE-2023-3299 Nomad Caller ACL Token's Secret ID is Exposed to Sentinel

HashiCorp Nomad Enterprise 1.2.11 up to 1.5.6, and 1.4.10 ACL policies using a block without a label generates unexpected results. Fixed in 1.6.0, 1.5.7, and 1.4.11...

CVE-2023-3299 Nomad Caller ACL Token's Secret ID is Exposed to Sentinel

HashiCorp Nomad Enterprise 1.2.11 up to 1.5.6, and 1.4.10 ACL policies using a block without a label generates unexpected results. Fixed in 1.6.0, 1.5.7, and 1.4.11...

CVE-2023-3072

CVE-2023-3072 affects HashiCorp Nomad and Nomad Enterprise: ACL policies using a block without a label can be applied to unexpected resources. Impact is stated as unexpected policy application to resources; affected versions are Nomad 0.7.0–1.5.6 and Nomad Enterprise 1.4.10 (also listed as 1.4.10...

CVE-2023-3072 Nomad ACL Policies without Label are Applied to Unexpected Resources

HashiCorp Nomad and Nomad Enterprise 0.7.0 up to 1.5.6 and 1.4.10 ACL policies using a block without a label generates unexpected results. Fixed in 1.6.0, 1.5.7, and 1.4.11...

CVE-2023-3072

Removed by vendor...

CVE-2023-3072 Nomad ACL Policies without Label are Applied to Unexpected Resources

HashiCorp Nomad and Nomad Enterprise 0.7.0 up to 1.5.6 and 1.4.10 ACL policies using a block without a label generates unexpected results. Fixed in 1.6.0, 1.5.7, and 1.4.11...

CVE-2023-3072 Nomad ACL Policies without Label are Applied to Unexpected Resources

HashiCorp Nomad and Nomad Enterprise 0.7.0 up to 1.5.6 and 1.4.10 ACL policies using a block without a label generates unexpected results. Fixed in 1.6.0, 1.5.7, and 1.4.11...

Nomad Search API Leaks Information About CSI Plugins

Summary A vulnerability was identified in Nomad and Nomad Enterprise “Nomad” such that the search HTTP API can reveal names of available CSI plugins to unauthenticated users or users without the plugin:read policy. This vulnerability, CVE-2023-3300, affects Nomad since 0.11 and was fixed in 1.6.0...

Nomad Caller ACL Token's Secret ID is Exposed to Sentinel

Summary A vulnerability was identified in Nomad Enterprise such that the API caller’s ACL token secret ID is exposed to Sentinel policies. This vulnerability, CVE-2023-3299, affects Nomad Enterprise from 1.2.11 up to 1.5.6, and 1.4.10 and was fixed in 1.6.0, 1.5.7, and 1.4.11. Background Nomad...

Nomad ACL Policies without Label are Applied to Unexpected Resources

Summary A vulnerability was identified in Nomad and Nomad Enterprise “Nomad” such an ACL policy using a block without label may be applied to unexpected resources. This vulnerability, CVE-2023-3072, affects Nomad from 0.7 up to 1.5.6 and 1.4.10 and was fixed in 1.6.0, 1.5.7, and 1.4.11. Backgroun...

PT-2023-24131 · Hashicorp +1 · Hashicorp Nomad +2

Name of the Vulnerable Software and Affected Versions: HashiCorp Nomad and Nomad Enterprise versions 0.11.0 through 1.5.6 HashiCorp Nomad and Nomad Enterprise version 1.4.1 Description: A vulnerability in the HTTP search API can reveal names of available CSI plugins to unauthenticated users or...