GHSA-c866-8gpw-p3mv

Source

https://github.com/advisories/GHSA-c866-8gpw-p3mv

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/02/GHSA-c866-8gpw-p3mv/GHSA-c866-8gpw-p3mv.json

JSON Data

https://api.test.osv.dev/v1/vulns/GHSA-c866-8gpw-p3mv

Aliases

Published

2024-02-08T21:30:38Z

Modified

2024-09-26T21:10:36Z

Severity

7.7 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:N/I:H/A:H CVSS Calculator

Summary

HashiCorp Nomad vulnerable to symlink attacks

Details

HashiCorp Nomad and Nomad Enterprise 1.5.13 up to 1.6.6, and 1.7.3 template renderer is vulnerable to arbitrary file write on the host as the Nomad client user through symlink attacks. Fixed in Nomad 1.7.4, 1.6.7, 1.5.14.

Database specific

{
    "nvd_published_at": "2024-02-08T20:15:52Z",
    "cwe_ids": [
        "CWE-59",
        "CWE-610"
    ],
    "severity": "HIGH",
    "github_reviewed": true,
    "github_reviewed_at": "2024-02-09T15:08:40Z"
}

References

Affected packages

Go / github.com/hashicorp/nomad

Package

Name: github.com/hashicorp/nomad; View open source insights on deps.dev
Purl: pkg:golang/github.com/hashicorp/nomad

Affected ranges

Type: SEMVER
Events: Introduced

1.5.13

Fixed

1.5.14

Affected versions

1.*

1.5.13

Go / github.com/hashicorp/nomad

Package

Name: github.com/hashicorp/nomad; View open source insights on deps.dev
Purl: pkg:golang/github.com/hashicorp/nomad

Affected ranges

Type: SEMVER
Events: Introduced

1.6.0

Fixed

1.6.7

Database specific

{
    "last_known_affected_version_range": "<= 1.6.6"
}