PT-2022-24518 · Hashicorp · Nomad+1

Published 2022-11-10 · Updated 2024-08-21 · CVE-2022-3867

Positive Technologies (AI Summary)

CVSS v3.1

2.7

Low

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions HashiCorp Nomad and Nomad Enterprise versions 1.4.0 through 1.4.1

Description The issue affects event stream subscribers using a token with TTL, allowing them to receive updates until token garbage is collected.

Recommendations For versions 1.4.0 through 1.4.1, update to version 1.4.2 to resolve the issue.

Fix

Insufficient Session Expiration

Weakness Enumeration

CWE-613

Related Identifiers

CVE-2022-3867

GHSA-9FMC-5FQ4-5JWH

GO-2022-1106

Affected Products

Nomad

Nomad Enterprise

References · 14

• https://cve.org/CVERecord?id=CVE-2022-3867 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-3867 · Security Note
• https://discuss.hashicorp.com/t/hcsec-2022-26-nomad-s-event-stream-subscriber-using-acl-token-with-ttl-receive-updates-until-garbage-collected/46168 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2022-1106 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-3867 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-3867 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-3867 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-9fmc-5fq4-5jwh · Vendor Advisory
• https://github.com/hashicorp/nomad · Note
• https://github.com/hashicorp/nomad/commit/dd6a4634a9652197fe4182e830f9a737d0ae1216 · Note
• https://t.me/cibsecurity/52909 · Telegram Post
• https://t.me/cvenotify/37483 · Telegram Post
• https://github.com/advisories/GHSA-9fmc-5fq4-5jwh · Note
• https://t.me/cvenotify/37773 · Telegram Post