hashicorp/nomad · Security
HashiCorp Nomad vulnerable to symlink attacks
- GHSA ID
- GHSA-c866-8gpw-p3mv
- CVE ID
- CVE-2024-1329
- Severity
- high
- Published
- Updated
- CVSS
- 7.7 · CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:N/I:H/A:H
- CVSS v3
- 7.7 · CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:N/I:H/A:H
Description
HashiCorp Nomad and Nomad Enterprise 1.5.13 up to 1.6.6, and 1.7.3 template renderer is vulnerable to arbitrary file write on the host as the Nomad client user through symlink attacks. Fixed in Nomad 1.7.4, 1.6.7, 1.5.14.
CWEs
- CWE-59 · Improper Link Resolution Before File Access ('Link Following')
- CWE-610 · Externally Controlled Reference to a Resource in Another Sphere
References
- https://nvd.nist.gov/vuln/detail/CVE-2024-1329 ↗
- https://discuss.hashicorp.com/t/hcsec-2024-03-nomad-vulnerable-to-arbitrary-write-through-symlink-attack ↗
- https://github.com/hashicorp/nomad/issues/19888 ↗
- https://github.com/hashicorp/nomad/commit/b3209cbc6921e703b0e9984ce70c10b378665834 ↗
- https://github.com/hashicorp/nomad/commit/d1721c7a6fc1833778086603f818a822a34f445a ↗
- https://github.com/hashicorp/nomad/commit/de55da677a21ac7572c0f4a8cd9abd5473c47a70 ↗
- https://github.com/advisories/GHSA-c866-8gpw-p3mv ↗