PT-2023-17240 · Hashicorp · Nomad+1

Publicado 2023-04-05 · Atualizado 2024-08-20 · CVE-2023-1782

Positive Technologies (AI Summary)

CVSS v3.1

9.9

Crítica

Vetor base

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions HashiCorp Nomad and Nomad Enterprise versions 1.5.0 through 1.5.2

Description The issue allows unauthenticated users to bypass intended ACL authorizations for clusters where mTLS is not enabled. This can lead to unauthorized access and potential privilege escalation. The problem is fixed in version 1.5.3.

Recommendations For versions 1.5.0 through 1.5.2, update to version 1.5.3 to resolve the issue. As a temporary workaround, consider enabling mTLS for clusters to minimize the risk of exploitation.

Correção

Missing Authorization

Improper Authorization

Enumeração de Fraquezas

CWE-862

CWE-285

Identificadores relacionados

CVE-2023-1782

GHSA-F8R8-H93M-MJ77

GO-2023-1707

Produtos afetados

Nomad

Nomad Enterprise

Referências · 13

• https://github.com/hashicorp/nomad · Nota
• https://t.me/cvenotify/47659 · Publicação no Telegram
• https://discuss.hashicorp.com/t/hcsec-2023-13-nomad-unauthenticated-client-agent-http-request-privilege-escalation/52375 · Nota
• https://osv.dev/vulnerability/CVE-2023-1782 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-1782 · Nota de Segurança
• https://osv.dev/vulnerability/GHSA-f8r8-h93m-mj77 · Aviso do Fabricante
• https://discuss.hashicorp.com/t/hcsec-2023-12-nomad-unauthenticated-client-agent-http-request-privilege-escalation/52375 · Aviso do Fabricante
• https://github.com/advisories/GHSA-f8r8-h93m-mj77 · Nota
• https://osv.dev/vulnerability/GO-2023-1707 · Aviso do Fabricante
• https://cve.org/CVERecord?id=CVE-2023-1782 · Nota de Segurança
• https://ubuntu.com/security/CVE-2023-1782 · Aviso do Fabricante
• https://t.me/cibsecurity/61523 · Publicação no Telegram
• https://osv.dev/vulnerability/UBUNTU-CVE-2023-1782 · Aviso do Fabricante