FreeBSD : nomad -- multiple vulnerabilities (618010ff-3044-11eb-8112-000c292ee6b8)

The HashiCorp team reports : - artifact: Fixed a bug where interpolation can be used in the artifact destination field to write artifact payloads outside the allocation directory. - template: Fixed a bug where interpolation can be used in the template source and destination fields to read or writ...

Nomad File Sandbox Escape via Container Volume Mount

Summary A vulnerability, CVE-2020-28348, was discovered in Nomad and Nomad Enterprise “Nomad” such that an operator with job submission capabilities can mount the host file system of a client agent and subvert the default Docker file sandbox feature when not explicitly disabled or when using a...

Nomad File Sandbox Escape via Template and Artifact Stanzas

Summary A vulnerability was identified in Nomad and Nomad Enterprise “Nomad” such that a specially crafted Nomad jobspec can be used to escape the client file sandbox configuration. This vulnerability, CVE-2020-27195, affects version 0.9.0 up to 0.12.5, and is fixed in the 0.12.6, 0.11.5, and...

Nomad's Raw File View Vulnerable to Cross-Site Scripting

Summary A vulnerability was identified in Nomad and Nomad Enterprise “Nomad” such that files from a malicious workload could cause arbitrary JavaScript to execute in the web UI. This vulnerability, CVE-2020-10944, affects all Nomad versions since 0.3 and is fixed in the 0.10.5 release. Background...

Nomad's mTLS Authorization Mechanism Susceptible to Privilege Escalation

Summary Nomad and Nomad Enterprise “Nomad” up to 0.10.2 incorrectly validated role/region associated with TLS certificates used for mTLS RPC, and were susceptible to privilege escalation. Assigned CVE-2020-7956, this vulnerability was fixed in Nomad 0.10.3. Background Securing Nomad’s cluster...

Nomad’s HTTP/RPC Services Allow Unbounded Resource Usage, Susceptible to Unauthenticated Denial of Service

Summary A vulnerability was identified in Nomad and Nomad Enterprise “Nomad” such that unbounded resource usage, triggered by the establishment of many unauthenticated HTTP or RPC connections, may generate excessive load and/or crash the server. This vulnerability, CVE-2020-7218, affects all...

Sandbox Escape

github.com/hashicorp/nomad is vulnerable to sandbox escape. The vulnerability exists through docker.volumes.enabled flag is not explicitly disabled or when using a volume mount type, subverts the default Docker file sandbox feature...

CVE-2020-28348

HashiCorp Nomad and Nomad Enterprise 0.9.0 up to 0.12.7 client Docker file sandbox feature may be subverted when not explicitly disabled or when using a volume mount type. Fixed in 0.12.8, 0.11.7, and 0.10.8...

CVE-2020-28348

HashiCorp Nomad and Nomad Enterprise 0.9.0 up to 0.12.7 client Docker file sandbox feature may be subverted when not explicitly disabled or when using a volume mount type. Fixed in 0.12.8, 0.11.7, and 0.10.8...

Design/Logic Flaw

HashiCorp Nomad and Nomad Enterprise 0.9.0 up to 0.12.7 client Docker file sandbox feature may be subverted when not explicitly disabled or when using a volume mount type. Fixed in 0.12.8, 0.11.7, and 0.10.8...

CVE-2020-28348

HashiCorp Nomad and Nomad Enterprise 0.9.0 up to 0.12.7 client Docker file sandbox feature may be subverted when not explicitly disabled or when using a volume mount type. Fixed in 0.12.8, 0.11.7, and 0.10.8...

CVE-2020-28348

HashiCorp Nomad and Nomad Enterprise 0.9.0 up to 0.12.7 client Docker file sandbox feature may be subverted when not explicitly disabled or when using a volume mount type. Fixed in 0.12.8, 0.11.7, and 0.10.8...

CVE-2020-28348

HashiCorp Nomad and Nomad Enterprise 0.9.0 up to 0.12.7 client Docker file sandbox feature may be subverted when not explicitly disabled or when using a volume mount type. Fixed in 0.12.8, 0.11.7, and 0.10.8...

CVE-2020-28348

HashiCorp Nomad and Nomad Enterprise vulnerable to a path traversal issue in the client Dockerfile sandbox feature for 0.9.0–0.12.7, potentially subverting isolation when not disabled or with volume mounts. Fixed in 0.12.8, 0.11.7, and 0.10.8. Upgrade to one of these versions (or apply vendor gui...

CVE-2020-28348

Removed by vendor...

PT-2020-16990 · Hashicorp +1 · Nomad +2

Name of the Vulnerable Software and Affected Versions: HashiCorp Nomad and Nomad Enterprise versions 0.9.0 through 0.12.7 Description: The client Docker file sandbox feature in HashiCorp Nomad and Nomad Enterprise may be subverted when not explicitly disabled or when using a volume mount type. Th...

HashiCorp Nomad and Nomad Enterprise Path Traversal Vulnerability

Hashicorp Nomad is a distributed, data center-aware cluster and application scheduler from Hashicorp, USA. The program supports the deployment of microservices, batch, containerized and non-containerized applications. A security vulnerability exists in HashiCorp Nomad and Nomad Enterprise version...

CVE-2020-27195

HashiCorp Nomad and Nomad Enterprise version 0.9.0 up to 0.12.5 client file sandbox feature can be subverted using either the template or artifact stanzas. Fixed in 0.12.6, 0.11.5, and 0.10.6...

Sandbox Restrictions Bypass

github.com/hashicorp/nomad is vulnerable to sandbox restrictions bypass. The vulnerability exists due to interpolation that can be used in the artifact destination field to write artifact payloads outside of the allocation directory...

CVE-2020-27195

HashiCorp Nomad and Nomad Enterprise version 0.9.0 up to 0.12.5 client file sandbox feature can be subverted using either the template or artifact stanzas. Fixed in 0.12.6, 0.11.5, and 0.10.6...