Use After Free in HashiCorp Nomad

2022-02-1501:57:18

Google

osv.dev

0.002 Low

EPSS

Percentile

55.1%

JSON

HashiCorp Nomad and Nomad Enterprise version 0.9.0 up to 0.12.5 client file sandbox feature can be subverted using either the template or artifact stanzas. Fixed in 0.12.6, 0.11.5, and 0.10.6

CPENameOperatorVersion
github.com/hashicorp/nomadlt0.10.6
github.com/hashicorp/nomadlt0.12.6
github.com/hashicorp/nomadge0.9.0
github.com/hashicorp/nomadge0.12.0
github.com/hashicorp/nomadge0.11.0
github.com/hashicorp/nomadlt0.11.5

Name	Operator	Version
github.com/hashicorp/nomad	lt	0.10.6
github.com/hashicorp/nomad	lt	0.12.6
github.com/hashicorp/nomad	ge	0.9.0
github.com/hashicorp/nomad	ge	0.12.0
github.com/hashicorp/nomad	ge	0.11.0
github.com/hashicorp/nomad	lt	0.11.5