PT-2022-16800 · Hashicorp · Nomad+1

Published 2022-02-14 · Updated 2024-08-21 · CVE-2022-24686

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions HashiCorp Nomad and Nomad Enterprise versions 0.3.0 through 1.0.17 HashiCorp Nomad and Nomad Enterprise version 1.1.11 HashiCorp Nomad and Nomad Enterprise version 1.2.5

Description The artifact download functionality in HashiCorp Nomad and Nomad Enterprise has a race condition, allowing the Nomad client agent to download the wrong artifact into the wrong destination.

Recommendations For versions 0.3.0 through 1.0.17, update to version 1.0.18. For version 1.1.11, update to version 1.1.12. For version 1.2.5, update to version 1.2.6.

Fix

Race Condition

Weakness Enumeration

CWE-362

Related Identifiers

CVE-2022-24686

GHSA-GWMC-6795-QGHJ

GO-2022-0600

Affected Products

Nomad

Nomad Enterprise

References · 15

• https://cve.org/CVERecord?id=CVE-2022-24686 · Security Note
• https://discuss.hashicorp.com/t/hcsec-2022-01-nomad-artifact-download-race-condition/35559 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-gwmc-6795-qghj · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-24686 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-24686 · Security Note
• https://discuss.hashicorp.com · Vendor Advisory
• https://osv.dev/vulnerability/GO-2022-0600 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-24686 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-24686 · Vendor Advisory
• https://github.com/hashicorp/nomad · Note
• https://github.com/hashicorp/nomad/releases/tag/v1.2.6 · Note
• https://github.com/hashicorp/nomad/issues/12036 · Note
• https://security.netapp.com/advisory/ntap-20220318-0008 · Note
• https://t.me/cibsecurity/37425 · Telegram Post
• https://github.com/advisories/GHSA-gwmc-6795-qghj · Note