GHSA-526x-rm7j-v389CriticalCVSS 9.8

Privilege escalation in Hashicorp Nomad

Published
June 3, 2022
Last Modified
January 27, 2023

🔗 CVE IDs covered (1)

CVE-2022-30324 →

📋 Description

HashiCorp Nomad and Nomad Enterprise version 0.2.0 up to 1.3.0 were impacted by go-getter vulnerabilities enabling privilege escalation through the artifact stanza in submitted jobs onto the client agent host. Fixed in 1.1.14, 1.2.8, and 1.3.1.

🎯 Affected products3

  • go/github.com/hashicorp/nomad:>= 0.2.0, < 1.1.14
  • go/github.com/hashicorp/nomad:>= 1.2.0, < 1.2.8
  • go/github.com/hashicorp/nomad:>= 1.3.0, < 1.3.1

🔗 References (4)