What is GHSA-7wg4-8m5p-hrfg?

GHSA-7wg4-8m5p-hrfg is a security advisory published by GitHub Security Advisories with Medium severity. HashiCorp Nomad vulnerable to non-sensitive metadata exposure

Which CVE IDs does GHSA-7wg4-8m5p-hrfg cover?

GHSA-7wg4-8m5p-hrfg covers the following CVE IDs: CVE-2022-3866. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-7wg4-8m5p-hrfg?

GHSA-7wg4-8m5p-hrfg has a CVSS v3 base score of 5.0, published by GitHub Security Advisories.

Which products are affected by GHSA-7wg4-8m5p-hrfg?

GHSA-7wg4-8m5p-hrfg affects 1 product, including: go/github.com/hashicorp/nomad:\u003e= 1.4.0, \u003c 1.4.2.

GHSA-7wg4-8m5p-hrfgMediumCVSS 5.0

HashiCorp Nomad vulnerable to non-sensitive metadata exposure

Vendor

GitHub Security Advisories

Published

November 10, 2022

Last Modified

May 31, 2023

🔗 CVE IDs covered (1)

CVE-2022-3866 →

📋 Description

HashiCorp Nomad and Nomad Enterprise 1.4.0 up to 1.4.1 workload identity token can list non-sensitive metadata for paths under nomad/ that belong to other jobs in the same namespace. Fixed in 1.4.2.

🎯 Affected products1

go/github.com/hashicorp/nomad:>= 1.4.0, < 1.4.2

🔗 References (4)

https://nvd.nist.gov/vuln/detail/CVE-2022-3866
https://discuss.hashicorp.com/t/hcsec-2022-25-nomad-s-workload-identity-token-can-list-non-sensitive-metadata-for-nomad-paths/46167
https://github.com/hashicorp/nomad/commit/3b24f26603e2b116ba324101afa8a7e3a7a769a5
https://github.com/advisories/GHSA-7wg4-8m5p-hrfg