CVE-2023-0821

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2023-0821

Import Source

https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2023-0821.json

JSON Data

https://api.test.osv.dev/v1/vulns/CVE-2023-0821

Aliases

Downstream

UBUNTU-CVE-2023-0821

Published

2023-02-16T21:23:24Z

Modified

2026-10-24T10:52:51Z

Severity

6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVSS Calculator

Summary

Nomad Client Vulnerable to Decompression Bombs in Artifact Block

Details

HashiCorp Nomad and Nomad Enterprise 1.2.15 up to 1.3.8, and 1.4.3 jobs using a maliciously compressed artifact stanza source can cause excessive disk usage. Fixed in 1.2.16, 1.3.9, and 1.4.4.

Database specific

{
    "cna_assigner": "HashiCorp",
    "cwe_ids": [
        "CWE-409"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/0xxx/CVE-2023-0821.json"
}

References

Affected packages

Git / github.com/hashicorp/nomad

Affected ranges

Type

GIT

Repo

https://github.com/hashicorp/nomad

Events

Introduced

Fixed

6c90f7ff7973180487add89eafa3378578eb5db3

Introduced

52e95d64113e01be05d585d8b4c07f6f19efebbc

Fixed

bbf16ea0c6165f5584012b610301904bca4d9c27

Introduced

ebaabc9e5ead691dbf1509ed8755ef1e24d4ddf7

Fixed

9101389d165dbc0df914ba15e674e85fb29de160

Database specific

Show details

{
    "extracted_events": [
        {
            "cpe": "cpe:2.3:a:hashicorp:nomad:*:*:*:*:-:*:*:*",
            "range": [
                {
                    "introduced": "0"
                },
                {
                    "fixed": "1.2.15"
                }
            ],
            "source": "CPE_RANGE"
        },
        {
            "cpe": "cpe:2.3:a:hashicorp:nomad:*:*:*:*:enterprise:*:*:*",
            "range": [
                {
                    "introduced": "0"
                },
                {
                    "fixed": "1.2.15"
                }
            ],
            "source": "CPE_RANGE"
        },
        {
            "cpe": "cpe:2.3:a:hashicorp:nomad:*:*:*:*:-:*:*:*",
            "range": [
                {
                    "introduced": "1.3.0"
                },
                {
                    "fixed": "1.3.9"
                }
            ],
            "source": "CPE_RANGE"
        },
        {
            "cpe": "cpe:2.3:a:hashicorp:nomad:*:*:*:*:enterprise:*:*:*",
            "range": [
                {
                    "introduced": "1.3.0"
                },
                {
                    "fixed": "1.3.9"
                }
            ],
            "source": "CPE_RANGE"
        },
        {
            "cpe": "cpe:2.3:a:hashicorp:nomad:*:*:*:*:-:*:*:*",
            "range": [
                {
                    "introduced": "1.4.0"
                },
                {
                    "fixed": "1.4.4"
                }
            ],
            "source": "CPE_RANGE"
        },
        {
            "cpe": "cpe:2.3:a:hashicorp:nomad:*:*:*:*:enterprise:*:*:*",
            "range": [
                {
                    "introduced": "1.4.0"
                },
                {
                    "fixed": "1.4.4"
                }
            ],
            "source": "CPE_RANGE"
        }
    ]
}

Affected versions

Other

show

v0.*

v0.0.0

v0.1.0

v0.1.1

v0.1.2

v0.10.0-beta1

v0.2.0

v0.2.1

v0.2.2

v0.2.3

v0.2.3-rc1

v0.3.0-rc2

v0.3.1

v0.3.2

v0.3.2-rc1

v0.3.2-rc2

v0.3rc1

v0.4.0

v0.4.0-rc1

v0.4.0-rc2

v0.4.1

v0.4.1-rc1

v0.5.0

v0.5.0-rc1

v0.5.0-rc2

v0.5.1

v0.5.1-rc1

v0.5.1-rc2

v0.5.2

v0.5.2-rc1

v0.5.3

v0.5.5

v0.5.5-rc1

v0.5.5-rc2

v0.5.6

v0.5.6-rc1

v0.6.0

v0.6.0-rc1

v0.6.0-rc2

v0.6.1

v0.6.2

v0.6.3-rc1

v0.7.0

v0.7.0-rc1

v0.7.0-rc2

v0.7.0-rc3

v0.7.1

v0.7.1+pro

v0.7.1-rc1

v0.7.1-rc1+pro

v0.8.0

v0.8.0+pro

v0.8.0-rc1

v0.8.0-rc1+pro

v0.8.2

v0.8.3

v0.8.4

v0.8.4-rc1

v0.9.0

v0.9.0-beta1

v0.9.0-beta2

v0.9.0-beta3

v0.9.0-rc1

v0.9.0-rc2

v0.9.2

v0.9.2-rc1

v0.9.3

v0.9.4

v0.9.4-rc1

v1.*

v1.2.4

v1.2.5

v1.2.6

v1.2.7

v1.2.9

v1.3.0

v1.3.2

v1.3.8

v1.3.9

v1.4.3

v1.4.4

Database specific

source

"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2023-0821.json"