Lucene search

GoogleOSV:GO-2022-0584

HistoryAug 21, 2024 - 3:11 p.m.

Arbitrary file reads in HashiCorp Nomad in github.com/hashicorp/nomad

2024-08-2115:11:38

Google

osv.dev

security vulnerability

file access

hashicorp nomad

CVSS2

7.8

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:C/I:N/A:N

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

AI Score

7.1

Confidence

Low

EPSS

0.002

Percentile

55.5%

JSON

Arbitrary file reads in HashiCorp Nomad in github.com/hashicorp/nomad

References

discuss.hashicorp.com

discuss.hashicorp.com/t/hcsec-2022-02-nomad-alloc-filesystem-and-container-escape/35560

github.com/advisories/GHSA-wmrx-57hm-mw7r

github.com/hashicorp/nomad/commit/1aa46c3796e924b72eb45a7f02dae32df0c1179c

github.com/hashicorp/nomad/commit/b3c0e6a7a53d624003698b48b6c59739552c3721

github.com/hashicorp/nomad/commit/fcb3a5d016a3dfcc63efcdb567373735a0703279

nvd.nist.gov/vuln/detail/CVE-2022-24683

security.netapp.com/advisory/ntap-20220318-0008

CVSS2

7.8

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:C/I:N/A:N

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

AI Score

7.1

Confidence

Low

EPSS

0.002

Percentile

55.5%

JSON

Related for OSV:GO-2022-0584