PT-2022-8093 · Hashicorp · Hashicorp Nomad

Published 2022-02-15 · Updated 2024-08-21 · CVE-2019-14802

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions HashiCorp Nomad versions 0.5.0 through 0.9.4

Description The issue reveals unintended environment variables to the rendering task during template rendering. This applies to the nomad/client/allocrunner/taskrunner/template module.

Recommendations For HashiCorp Nomad versions 0.5.0 through 0.9.4, update to version 0.9.5 to resolve the issue. As a temporary workaround, consider restricting access to sensitive environment variables until the update is applied.

Fix

Information Disclosure

Weakness Enumeration

CWE-526

CWE-200

Related Identifiers

CVE-2019-14802

GHSA-6HV3-7C34-4HX8

GO-2022-0634

Affected Products

Hashicorp Nomad

References · 17

• https://osv.dev/vulnerability/GHSA-6hv3-7c34-4hx8 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-14802 · Security Note
• https://ubuntu.com/security/CVE-2019-14802 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-14802 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2019-14802 · Security Note
• https://osv.dev/vulnerability/GO-2022-0634 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2019-14802 · Vendor Advisory
• https://hashicorp.com/blog/category/nomad · Vendor Advisory
• https://github.com/hashicorp/nomad · Note
• https://github.com/hashicorp/nomad/pull/6055 · Note
• https://github.com/hashicorp/nomad/releases/tag/v0.9.5 · Note
• https://github.com/hashicorp/nomad/commit/e8238305ef0b9ef37be3efd86a8d34bfbed5f63f · Note
• https://t.me/cvenotify/40735 · Telegram Post
• https://github.com/advisories/GHSA-6hv3-7c34-4hx8 · Note
• https://advisories.gitlab.com/advisory/advgo_github_com_hashicorp_nomad_client_allocrunner_taskrunner_template_GMS_2022_818.html · Note