PT-2021-23842 · Hashicorp · Nomad+1

Published 2021-12-03 · Updated 2024-08-21 · CVE-2021-43415

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions HashiCorp Nomad and Nomad Enterprise versions 1.0.13 and earlier, 1.1.7 and earlier, 1.2.0 and earlier

Description The issue allowed authenticated users with job submission capabilities to bypass the configured allowed image paths when the QEMU task driver was enabled.

Recommendations For versions 1.0.13 and earlier, update to version 1.0.14 or later. For versions 1.1.7 and earlier, update to version 1.1.8 or later. For versions 1.2.0 and earlier, update to version 1.2.1 or later.

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2021-43415

GHSA-2JHH-5XM2-J4GF

GO-2022-0573

Affected Products

Nomad

Nomad Enterprise

References · 12

• https://osv.dev/vulnerability/GO-2022-0573 · Vendor Advisory
• https://discuss.hashicorp.com/t/hcsec-2021-31-nomad-qemu-task-driver-allowed-paths-bypass-with-job-args/32288 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-43415 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-43415 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2021-43415 · Security Note
• https://osv.dev/vulnerability/GHSA-2jhh-5xm2-j4gf · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-43415 · Security Note
• https://hashicorp.com/blog/category/nomad · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-43415 · Vendor Advisory
• https://github.com/hashicorp/nomad · Note
• https://github.com/advisories/GHSA-2jhh-5xm2-j4gf · Note
• https://t.me/cibsecurity/33345 · Telegram Post