CVSS: 9.8EPSS: 0%CPEs: 6EXPL: 0CVE-2022-30324
https://notcve.org/view.php?id=CVE-2022-30324
HashiCorp Nomad and Nomad Enterprise version 0.2.0 up to 1.3.0 were impacted by go-getter vulnerabilities enabling privilege escalation through the artifact stanza in submitted jobs onto the client agent host. Fixed in 1.1.14, 1.2.8, and 1.3.1. HashiCorp Nomad y Nomad Enterprise versiones 0.2.0 hasta 1.3.0, fueron impactados por vulnerabilidades de go-getter que permiten una escalada de privilegios mediante la estrofa de artefactos en los trabajos enviados en el host del agente cliente. Corregido en versiones 1.1.14, 1.2.8 y 1.3.1 • https://discuss.hashicorp.com https://discuss.hashicorp.com/t/hcsec-2022-14-nomad-impacted-by-go-getter-vulnerabilities/39932 •
CVSS: 7.5EPSS: 0%CPEs: 6EXPL: 0CVE-2022-24685
https://notcve.org/view.php?id=CVE-2022-24685
HashiCorp Nomad and Nomad Enterprise 1.0.17, 1.1.11, and 1.2.5 allow invalid HCL for the jobs parse endpoint, which may cause excessive CPU usage. Fixed in 1.0.18, 1.1.12, and 1.2.6. HashiCorp Nomad y Nomad Enterprise versiones 1.0.17, 1.1.11 y 1.2.5 permiten HCL no válidos para el punto final de análisis de trabajos, lo que puede causar un uso excesivo de la CPU. Corregido en las versiones 1.0.18, 1.1.12 y 1.2.6. • https://discuss.hashicorp.com https://discuss.hashicorp.com/t/hcsec-2022-03-nomad-malformed-job-parsing-results-in-excessive-cpu-usage https://discuss.hashicorp.com/t/hcsec-2022-03-nomad-malformed-job-parsing-results-in-excessive-cpu-usage/35561 https://security.netapp.com/advisory/ntap-20220331-0007 • CWE-770: Allocation of Resources Without Limits or Throttling •
CVSS: 7.8EPSS: 0%CPEs: 6EXPL: 0CVE-2022-24683
https://notcve.org/view.php?id=CVE-2022-24683
HashiCorp Nomad and Nomad Enterprise 0.9.2 through 1.0.17, 1.1.11, and 1.2.5 allow operators with read-fs and alloc-exec (or job-submit) capabilities to read arbitrary files on the host filesystem as root. HashiCorp Nomad y Nomad Enterprise versiones 0.9.2 hasta 1.0.17, 1.1.11 y 1.2.5 permiten a operadores con capacidades read-fs y alloc-exec (o job-submit) leer archivos arbitrarios en el sistema de archivos del host como root • https://discuss.hashicorp.com https://discuss.hashicorp.com/t/hcsec-2022-02-nomad-alloc-filesystem-and-container-escape/35560 https://security.netapp.com/advisory/ntap-20220318-0008 •
CVSS: 6.5EPSS: 0%CPEs: 6EXPL: 0CVE-2022-24684
https://notcve.org/view.php?id=CVE-2022-24684
HashiCorp Nomad and Nomad Enterprise 0.9.0 through 1.0.16, 1.1.11, and 1.2.5 allow operators with job-submit capabilities to use the spread stanza to panic server agents. Fixed in 1.0.18, 1.1.12, and 1.2.6. HashiCorp Nomad y Nomad Enterprise versiones 0.9.0 hasta 1.0.16, 1.1.11 y 1.2.5 permiten a los operadores con capacidades de envío de trabajos utilizar la estrofa de propagación para hacer entrar en pánico a los agentes del servidor. Corregido en las versiones 1.0.18, 1.1.12 y 1.2.6. • https://discuss.hashicorp.com https://discuss.hashicorp.com/t/hcsec-2022-04-nomad-spread-job-stanza-may-trigger-panic-in-servers https://discuss.hashicorp.com/t/hcsec-2022-04-nomad-spread-job-stanza-may-trigger-panic-in-servers/35562 https://security.netapp.com/advisory/ntap-20220318-0008 •
CVSS: 5.9EPSS: 0%CPEs: 6EXPL: 0CVE-2022-24686
https://notcve.org/view.php?id=CVE-2022-24686
HashiCorp Nomad and Nomad Enterprise 0.3.0 through 1.0.17, 1.1.11, and 1.2.5 artifact download functionality has a race condition such that the Nomad client agent could download the wrong artifact into the wrong destination. Fixed in 1.0.18, 1.1.12, and 1.2.6 La funcionalidad artifact download de HashiCorp Nomad y Nomad Enterprise versiones 0.3.0 hasta 1.0.17, 1.1.11 y 1.2.5, presenta una condición de carrera que hace que el agente cliente de Nomad pueda descargar el artefacto equivocado en el destino equivocado. Corregido en versiones 1.0.18, 1.1.12 y 1.2.6 • https://discuss.hashicorp.com https://discuss.hashicorp.com/t/hcsec-2022-01-nomad-artifact-download-race-condition/35559 https://security.netapp.com/advisory/ntap-20220318-0008 • CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') •