GHSA-c866-8gpw-p3mv

Suggest an improvement
Source
https://github.com/advisories/GHSA-c866-8gpw-p3mv
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/02/GHSA-c866-8gpw-p3mv/GHSA-c866-8gpw-p3mv.json
JSON Data
https://api.test.osv.dev/v1/vulns/GHSA-c866-8gpw-p3mv
Aliases
Published
2024-02-08T21:30:38Z
Modified
2024-09-26T21:10:36Z
Severity
  • 7.7 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:N/I:H/A:H CVSS Calculator
Summary
HashiCorp Nomad vulnerable to symlink attacks
Details

HashiCorp Nomad and Nomad Enterprise 1.5.13 up to 1.6.6, and 1.7.3 template renderer is vulnerable to arbitrary file write on the host as the Nomad client user through symlink attacks. Fixed in Nomad 1.7.4, 1.6.7, 1.5.14.

Database specific
{
    "nvd_published_at": "2024-02-08T20:15:52Z",
    "cwe_ids": [
        "CWE-59",
        "CWE-610"
    ],
    "severity": "HIGH",
    "github_reviewed": true,
    "github_reviewed_at": "2024-02-09T15:08:40Z"
}
References

Affected packages

Go / github.com/hashicorp/nomad

Package

Name
github.com/hashicorp/nomad
View open source insights on deps.dev
Purl
pkg:golang/github.com/hashicorp/nomad

Affected ranges

Type
SEMVER
Events
Introduced
1.5.13
Fixed
1.5.14

Affected versions

1.*

1.5.13

Go / github.com/hashicorp/nomad

Package

Name
github.com/hashicorp/nomad
View open source insights on deps.dev
Purl
pkg:golang/github.com/hashicorp/nomad

Affected ranges

Type
SEMVER
Events
Introduced
1.6.0
Fixed
1.6.7

Database specific

{
    "last_known_affected_version_range": "<= 1.6.6"
}

Go / github.com/hashicorp/nomad

Package

Name
github.com/hashicorp/nomad
View open source insights on deps.dev
Purl
pkg:golang/github.com/hashicorp/nomad

Affected ranges

Type
SEMVER
Events
Introduced
1.7.3
Fixed
1.7.4

Affected versions

1.*

1.7.3