PT-2022-24509 · Hashicorp · Nomad+1

Published 2022-11-10 · Updated 2024-08-21 · CVE-2022-3866

Positive Technologies (AI Summary)

CVSS v3.1

5.0

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions HashiCorp Nomad and Nomad Enterprise versions 1.4.0 through 1.4.1

Description The issue allows a workload identity token to list non-sensitive metadata for paths under nomad/ that belong to other jobs in the same namespace.

Recommendations For versions 1.4.0 through 1.4.1, update to version 1.4.2 to resolve the issue.

Fix

Exposure of Resource to Wrong Sphere

Weakness Enumeration

CWE-668

Related Identifiers

CVE-2022-3866

GHSA-7WG4-8M5P-HRFG

GO-2022-1105

Affected Products

Nomad

Nomad Enterprise

References · 13

• https://nvd.nist.gov/vuln/detail/CVE-2022-3866 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-3866 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2022-1105 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-7wg4-8m5p-hrfg · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2022-3866 · Security Note
• https://discuss.hashicorp.com/t/hcsec-2022-25-nomad-s-workload-identity-token-can-list-non-sensitive-metadata-for-nomad-paths/46167 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-3866 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-3866 · Vendor Advisory
• https://github.com/hashicorp/nomad · Note
• https://github.com/hashicorp/nomad/commit/3b24f26603e2b116ba324101afa8a7e3a7a769a5 · Note
• https://github.com/advisories/GHSA-7wg4-8m5p-hrfg · Note
• https://t.me/cibsecurity/52902 · Telegram Post
• https://t.me/cvenotify/37772 · Telegram Post