CVSS: 9.8EPSS: 0%CPEs: 6EXPL: 0CVE-2022-30324
https://notcve.org/view.php?id=CVE-2022-30324
HashiCorp Nomad and Nomad Enterprise version 0.2.0 up to 1.3.0 were impacted by go-getter vulnerabilities enabling privilege escalation through the artifact stanza in submitted jobs onto the client agent host. Fixed in 1.1.14, 1.2.8, and 1.3.1. HashiCorp Nomad y Nomad Enterprise versiones 0.2.0 hasta 1.3.0, fueron impactados por vulnerabilidades de go-getter que permiten una escalada de privilegios mediante la estrofa de artefactos en los trabajos enviados en el host del agente cliente. Corregido en versiones 1.1.14, 1.2.8 y 1.3.1 • https://discuss.hashicorp.com https://discuss.hashicorp.com/t/hcsec-2022-14-nomad-impacted-by-go-getter-vulnerabilities/39932 •
CVSS: 7.8EPSS: 0%CPEs: 6EXPL: 0CVE-2022-24683
https://notcve.org/view.php?id=CVE-2022-24683
HashiCorp Nomad and Nomad Enterprise 0.9.2 through 1.0.17, 1.1.11, and 1.2.5 allow operators with read-fs and alloc-exec (or job-submit) capabilities to read arbitrary files on the host filesystem as root. HashiCorp Nomad y Nomad Enterprise versiones 0.9.2 hasta 1.0.17, 1.1.11 y 1.2.5 permiten a operadores con capacidades read-fs y alloc-exec (o job-submit) leer archivos arbitrarios en el sistema de archivos del host como root • https://discuss.hashicorp.com https://discuss.hashicorp.com/t/hcsec-2022-02-nomad-alloc-filesystem-and-container-escape/35560 https://security.netapp.com/advisory/ntap-20220318-0008 •
CVSS: 6.5EPSS: 0%CPEs: 6EXPL: 0CVE-2022-24684
https://notcve.org/view.php?id=CVE-2022-24684
HashiCorp Nomad and Nomad Enterprise 0.9.0 through 1.0.16, 1.1.11, and 1.2.5 allow operators with job-submit capabilities to use the spread stanza to panic server agents. Fixed in 1.0.18, 1.1.12, and 1.2.6. HashiCorp Nomad y Nomad Enterprise versiones 0.9.0 hasta 1.0.16, 1.1.11 y 1.2.5 permiten a los operadores con capacidades de envío de trabajos utilizar la estrofa de propagación para hacer entrar en pánico a los agentes del servidor. Corregido en las versiones 1.0.18, 1.1.12 y 1.2.6. • https://discuss.hashicorp.com https://discuss.hashicorp.com/t/hcsec-2022-04-nomad-spread-job-stanza-may-trigger-panic-in-servers https://discuss.hashicorp.com/t/hcsec-2022-04-nomad-spread-job-stanza-may-trigger-panic-in-servers/35562 https://security.netapp.com/advisory/ntap-20220318-0008 •
CVSS: 5.9EPSS: 0%CPEs: 6EXPL: 0CVE-2022-24686
https://notcve.org/view.php?id=CVE-2022-24686
HashiCorp Nomad and Nomad Enterprise 0.3.0 through 1.0.17, 1.1.11, and 1.2.5 artifact download functionality has a race condition such that the Nomad client agent could download the wrong artifact into the wrong destination. Fixed in 1.0.18, 1.1.12, and 1.2.6 La funcionalidad artifact download de HashiCorp Nomad y Nomad Enterprise versiones 0.3.0 hasta 1.0.17, 1.1.11 y 1.2.5, presenta una condición de carrera que hace que el agente cliente de Nomad pueda descargar el artefacto equivocado en el destino equivocado. Corregido en versiones 1.0.18, 1.1.12 y 1.2.6 • https://discuss.hashicorp.com https://discuss.hashicorp.com/t/hcsec-2022-01-nomad-artifact-download-race-condition/35559 https://security.netapp.com/advisory/ntap-20220318-0008 • CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') •
CVSS: 8.8EPSS: 0%CPEs: 4EXPL: 0CVE-2021-37218
https://notcve.org/view.php?id=CVE-2021-37218
HashiCorp Nomad and Nomad Enterprise Raft RPC layer allows non-server agents with a valid certificate signed by the same CA to access server-only functionality, enabling privilege escalation. Fixed in 1.0.10 and 1.1.4. La capa RPC de HashiCorp Nomad y Nomad Enterprise Raft permite a agentes no servidores con un certificado válido firmado por la misma CA acceder a la funcionalidad server-only, permitiendo una escalada de privilegios. Corregido en versiones 1.0.10 y 1.1.4 • https://discuss.hashicorp.com/t/hcsec-2021-21-nomad-raft-rpc-privilege-escalation/29023 https://www.hashicorp.com/blog/category/nomad • CWE-295: Improper Certificate Validation •