PT-2023-22921 · Hashicorp+1 · Nomad Enterprise+2

CVE-2023-3072 · Publicado 2023-07-19 · Atualizado 2025-05-26

Positive Technologies (AI Summary)

CVSS v2.0

4.7

Média

Vetor base

AV:N/AC:L/Au:M/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions HashiCorp Nomad and Nomad Enterprise versions 0.7.0 through 1.5.6 HashiCorp Nomad and Nomad Enterprise version 1.4.10

Description A vulnerability in HashiCorp Nomad and Nomad Enterprise allows an ACL policy using a block without a label to generate unexpected results, potentially applying to unexpected resources. This issue affects the Nomad scheduler, designed for effortless operations and management of applications.

Recommendations For HashiCorp Nomad and Nomad Enterprise versions 0.7.0 through 1.5.6, update to version 1.5.7 or later to resolve the issue. For HashiCorp Nomad and Nomad Enterprise version 1.4.10, update to version 1.4.11 to resolve the issue. As a temporary workaround, consider restricting the use of ACL policies using blocks without labels until a patch is available.

Exploit

Correção

Missing Authorization

Incorrect Privilege Assignment

Enumeração de Fraquezas

CWE-862

CWE-266

Identificadores relacionados

BDU:2025-06166

CVE-2023-3072

GHSA-RPVR-38XV-XVXQ

GO-2024-2670

Produtos afetados

Hashicorp Nomad

Nomad Enterprise

Red Os

Referências · 15

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/3xxx/CVE-2023-3072.json · Exploit
• https://github.com/hashicorp/nomad · Nota
• https://t.me/cvenotify/96231 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2023-3072 · Nota de Segurança
• https://bdu.fstec.ru/vul/2025-06166 · Nota de Segurança
• https://ubuntu.com/security/CVE-2023-3072 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2023-3072 · Aviso do Fabricante
• https://discuss.hashicorp.com/t/hcsec-2023-20-nomad-acl-policies-without-label-are-applied-to-unexpected-resources/56270 · Aviso do Fabricante
• https://redos.red-soft.ru/support/secure/uyazvimosti/support/secure/uyazvimosti/uyazvimost-nomad-cve-2023-3072 · Nota
• https://cve.org/CVERecord?id=CVE-2023-3072 · Nota de Segurança
• https://pkg.go.dev/vuln/GO-2024-2670 · Nota
• https://osv.dev/vulnerability/GHSA-rpvr-38xv-xvxq · Aviso do Fabricante
• https://osv.dev/vulnerability/UBUNTU-CVE-2023-3072 · Aviso do Fabricante
• https://redos.red-soft.ru/support/secure · Nota
• https://osv.dev/vulnerability/GO-2024-2670 · Aviso do Fabricante