PT-2021-23435 · Hashicorp · Nomad Enterprise+2

Published 2021-10-07 · Updated 2021-10-15 · CVE-2021-41865

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions HashiCorp Nomad and Nomad Enterprise versions 1.1.1 through 1.1.5

Description The issue allows authenticated users with job submission capabilities to cause a denial of service by submitting incomplete job specifications when using a Consul mesh gateway and host networking mode.

Recommendations For versions 1.1.1 through 1.1.5, update to version 1.1.6 to resolve the issue.

Fix

Related Identifiers

CVE-2021-41865

Affected Products

Hashicorp Consul

Nomad

Nomad Enterprise

References · 9

• https://discuss.hashicorp.com/t/hcsec-2021-26-nomad-denial-of-service-via-submission-of-incomplete-job-specification-using-consul-mesh-gateway-host-network/30311 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-41865 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-41865 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-41865 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2021-41865 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2021-41865 · Security Note
• https://github.com/hashicorp/nomad/issues/11243 · Note
• https://github.com/hashicorp/nomad/pull/11257 · Note
• https://t.me/cibsecurity/30161 · Telegram Post