Nomad Spread Job Stanza May Trigger Panic in Servers

Summary Nomad and Nomad Enterprise “Nomad” allows operators with job-submit capabilities to use the spread stanza in a way such that it can cause panic in Nomad servers. This vulnerability, CVE-2022-24684, was fixed in Nomad 1.0.18, 1.1.12, and 1.2.6. Background The spread stanza within a Nomad j...

Nomad’s HTTP/RPC Services Allow Unbounded Resource Usage, Susceptible to Unauthenticated Denial of Service

Summary A vulnerability was identified in Nomad and Nomad Enterprise “Nomad” such that unbounded resource usage, triggered by the establishment of many unauthenticated HTTP or RPC connections, may generate excessive load and/or crash the server. This vulnerability, CVE-2020-7218, affects all...