PT-2020-19472 · Hashicorp · Nomad+1

Published 2020-01-31 · Updated 2024-08-21 · CVE-2020-7218

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions HashiCorp Nomad and Nomad Enterprise versions prior to 0.10.3

Description The issue allows unbounded resource usage and is susceptible to unauthenticated denial of service. This affects the HTTP/RPC services.

Recommendations For versions prior to 0.10.3, update to version 0.10.3 to resolve the issue. As a temporary workaround, consider restricting access to the HTTP/RPC services to minimize the risk of exploitation.

Fix

Allocation of Resources Without Limits

Resource Exhaustion

Weakness Enumeration

CWE-770

CWE-400

Related Identifiers

CVE-2020-7218

GHSA-H43V-26R7-7J4C

GO-2022-0840

Affected Products

Nomad

Nomad Enterprise

References · 13

• https://osv.dev/vulnerability/GO-2022-0840 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2020-7218 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-7218 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2020-7218 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2020-7218 · Security Note
• https://osv.dev/vulnerability/GHSA-h43v-26r7-7j4c · Vendor Advisory
• https://hashicorp.com/blog/category/nomad · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-7218 · Vendor Advisory
• https://github.com/hashicorp/nomad · Note
• https://github.com/hashicorp/nomad/issues/7002 · Note
• https://github.com/hashicorp/nomad/pull/7022 · Note
• https://t.me/cvenotify/696 · Telegram Post
• https://github.com/advisories/GHSA-h43v-26r7-7j4c · Note