PT-2022-16798 · Hashicorp · Nomad+1

Published 2022-02-15 · Updated 2024-08-21 · CVE-2022-24684

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions HashiCorp Nomad and Nomad Enterprise versions 0.9.0 through 1.0.16 HashiCorp Nomad and Nomad Enterprise version 1.1.11 HashiCorp Nomad and Nomad Enterprise version 1.2.5 HashiCorp Nomad and Nomad Enterprise versions prior to 1.0.17 HashiCorp Nomad and Nomad Enterprise versions 1.1.x prior to 1.1.12 HashiCorp Nomad and Nomad Enterprise versions 1.2.x prior to 1.2.6

Description The issue allows operators with job-submit capabilities to use the spread stanza to panic server agents, resulting in Uncontrolled Resource Consumption.

Recommendations For versions 0.9.0 through 1.0.16, update to version 1.0.18 or later. For version 1.1.11, update to version 1.1.12 or later. For version 1.2.5, update to version 1.2.6 or later. For versions prior to 1.0.17, update to version 1.0.17 or later. For versions 1.1.x prior to 1.1.12, update to version 1.1.12 or later. For versions 1.2.x prior to 1.2.6, update to version 1.2.6 or later. As a temporary workaround, consider restricting the use of the spread stanza in job submissions until a patch is available.

Fix

Resource Exhaustion

Weakness Enumeration

CWE-400

Related Identifiers

CVE-2022-24684

GHSA-6JM6-CMCP-FQJQ

GO-2022-0560

Affected Products

Nomad

Nomad Enterprise

References · 15

• https://osv.dev/vulnerability/UBUNTU-CVE-2022-24684 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-24684 · Security Note
• https://discuss.hashicorp.com/t/hcsec-2022-04-nomad-spread-job-stanza-may-trigger-panic-in-servers/35562 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-6jm6-cmcp-fqjq · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-24684 · Vendor Advisory
• https://discuss.hashicorp.com · Vendor Advisory
• https://osv.dev/vulnerability/GO-2022-0560 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-24684 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2022-24684 · Security Note
• https://github.com/hashicorp/nomad · Note
• https://github.com/advisories/GHSA-6jm6-cmcp-fqjq · Note
• https://security.netapp.com/advisory/ntap-20220318-0008 · Note
• https://t.me/cibsecurity/37495 · Telegram Post
• https://discuss.hashicorp.com/t/hcsec-2022-04-nomad-spread-job-stanza-may-trigger-panic-in-servers · Note
• https://t.me/cvenotify/26804 · Telegram Post