PT-2020-16658 · Hashicorp · Nomad Enterprise+1

Published 2020-10-22 · Updated 2024-08-21 · CVE-2020-27195

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions HashiCorp Nomad and Nomad Enterprise versions 0.9.0 through 0.12.5

Description The client file sandbox feature in HashiCorp Nomad and Nomad Enterprise can be subverted using either the template or artifact stanzas. This issue is related to a Use After Free condition. The estimated number of potentially affected devices worldwide is not specified. Details about real-world incidents where this issue was exploited are not provided.

Recommendations For versions 0.9.0 through 0.10.5, update to version 0.10.6. For versions 0.11.0 through 0.11.4, update to version 0.11.5. For versions 0.12.0 through 0.12.5, update to version 0.12.6. As a temporary workaround, consider restricting the use of the template and artifact stanzas in the client file sandbox feature until a patch is applied.

Fix

Use After Free

Weakness Enumeration

CWE-416

Related Identifiers

CVE-2020-27195

GHSA-77CR-6GR8-7RR9

GO-2022-0806

Affected Products

Nomad

Nomad Enterprise

References · 15

• https://osv.dev/vulnerability/UBUNTU-CVE-2020-27195 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-27195 · Security Note
• https://ubuntu.com/security/CVE-2020-27195 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-27195 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2020-27195 · Security Note
• https://osv.dev/vulnerability/GO-2022-0806 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-77cr-6gr8-7rr9 · Vendor Advisory
• https://github.com/hashicorp/nomad/blob/master/CHANGELOG.md#0126-october-21-2020 · Note
• https://github.com/hashicorp/nomad/issues/9129 · Note
• https://github.com/hashicorp/nomad/commit/a8ea7c5f421297db434b45046fca7a9deef6df85 · Note
• https://github.com/hashicorp/nomad/pull/9139 · Note
• https://pkg.go.dev/github.com/hashicorp/nomad/client/allocrunner/taskrunner/template · Note
• https://github.com/advisories/GHSA-77cr-6gr8-7rr9 · Note
• https://nomadproject.io/downloads · Note
• https://t.me/cibsecurity/15529 · Telegram Post