PT-2020-19875 · Hashicorp · Nomad Enterprise+1

Schmichael · Published 2020-01-31 · Updated 2024-08-21 · CVE-2020-7956

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions HashiCorp Nomad and Nomad Enterprise versions up to 0.10.2

Description The issue concerns improper validation of role/region associated with TLS certificates used for mTLS RPC, making the system susceptible to privilege escalation.

Recommendations For HashiCorp Nomad and Nomad Enterprise versions up to 0.10.2, update to version 0.10.3 to resolve the issue.

Fix

Improper Certificate Validation

Weakness Enumeration

CWE-295

Related Identifiers

CVE-2020-7956

GHSA-CJ2H-WW36-V932

GO-2022-0821

Affected Products

Nomad

Nomad Enterprise

References · 12

• https://osv.dev/vulnerability/CVE-2020-7956 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-7956 · Security Note
• https://hashicorp.com/blog/category/nomad · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-7956 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2022-0821 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2020-7956 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2020-7956 · Security Note
• https://osv.dev/vulnerability/GHSA-cj2h-ww36-v932 · Vendor Advisory
• https://github.com/hashicorp/nomad/issues/7003 · Note
• https://github.com/hashicorp/nomad/pull/7023 · Note
• https://t.me/cvenotify/700 · Telegram Post
• https://github.com/advisories/GHSA-cj2h-ww36-v932 · Note