PT-2022-16799 · Hashicorp · Nomad+1

CVE-2022-24685 · Published 2022-02-28 · Updated 2024-08-21

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions HashiCorp Nomad and Nomad Enterprise versions prior to 1.0.17 HashiCorp Nomad and Nomad Enterprise versions prior to 1.1.12 HashiCorp Nomad and Nomad Enterprise versions prior to 1.2.6

Description The issue allows for invalid HCL for the jobs parse endpoint, potentially causing excessive CPU usage due to uncontrolled resource consumption or allocation of resources without limits or throttling.

Recommendations For versions prior to 1.0.17, update to version 1.0.18 or later. For versions prior to 1.1.12, update to version 1.1.12 or later. For versions prior to 1.2.6, update to version 1.2.6 or later.

Exploit

Fix

Allocation of Resources Without Limits

Weakness Enumeration

CWE-770

Related Identifiers

CVE-2022-24685

GHSA-3382-R9Q8-4HFG

GO-2022-0577

Affected Products

Nomad

Nomad Enterprise

References · 15

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/24xxx/CVE-2022-24685.json · Exploit
• https://ubuntu.com/security/CVE-2022-24685 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-24685 · Vendor Advisory
• https://discuss.hashicorp.com · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-24685 · Security Note
• https://cve.org/CVERecord?id=CVE-2022-24685 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-24685 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-3382-r9q8-4hfg · Vendor Advisory
• https://osv.dev/vulnerability/GO-2022-0577 · Vendor Advisory
• https://discuss.hashicorp.com/t/hcsec-2022-03-nomad-malformed-job-parsing-results-in-excessive-cpu-usage/35561 · Vendor Advisory
• https://security.netapp.com/advisory/ntap-20220331-0007 · Note
• https://discuss.hashicorp.com/t/hcsec-2022-03-nomad-malformed-job-parsing-results-in-excessive-cpu-usage · Note
• https://t.me/cibsecurity/38171 · Telegram Post
• https://t.me/cvenotify/27896 · Telegram Post
• https://github.com/advisories/GHSA-3382-r9q8-4hfg · Note