CVE-2020-28348: Path Traversal
First published: Tue Nov 24 2020(Updated: )
HashiCorp Nomad and Nomad Enterprise 0.9.0 up to 0.12.7 client Docker file sandbox feature (github.com/hashicorp/nomad/drivers/docker) may be subverted when not explicitly disabled or when using a volume mount type. Fixed in 0.12.8, 0.11.7, and 0.10.8.
Credit: cve@mitre.org cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| go/github.com/hashicorp/nomad | >=0.12.0-beta1<0.12.8 | 0.12.8 |
| go/github.com/hashicorp/nomad | >=0.11.0-beta1<0.11.7 | 0.11.7 |
| go/github.com/hashicorp/nomad | >=0.9.0<0.10.8 | 0.10.8 |
| HashiCorp Nomad | >=0.9.0<0.10.8 | |
| HashiCorp Nomad | >=0.11.0<0.11.7 | |
| HashiCorp Nomad | >=0.12.0<0.12.8 | |
| HashiCorp Nomad | >=0.9.0<0.10.8 | |
| HashiCorp Nomad | >=0.11.0<0.11.7 | |
| HashiCorp Nomad | >=0.12.0<0.12.8 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://nvd.nist.gov/vuln/detail/CVE-2020-28348
- https://github.com/hashicorp/nomad/issues/9303
- https://github.com/hashicorp/nomad/pull/9321
- https://discuss.hashicorp.com/t/nomad-0-12-8-0-11-7-and-0-10-8-released/17491
- https://github.com/hashicorp/nomad/blob/master/CHANGELOG.md#0128-november-10-2020
- https://github.com/advisories/GHSA-5x92-p4p5-33c4 (Advisory)
Frequently Asked Questions
What is the vulnerability ID for this issue?
The vulnerability ID is CVE-2020-28348.
What is the severity rating of CVE-2020-28348?
The severity rating of CVE-2020-28348 is medium (6.5).
How can the Nomad client Docker file sandbox feature be subverted?
The Nomad client Docker file sandbox feature can be subverted when not explicitly disabled or when using a volume mount type.
What versions of HashiCorp Nomad and Nomad Enterprise are affected by this vulnerability?
HashiCorp Nomad and Nomad Enterprise versions 0.9.0 up to 0.12.7 are affected.
How can I fix the vulnerability?
You can fix the vulnerability by updating to version 0.12.8, 0.11.7, or 0.10.8 of HashiCorp Nomad, depending on your current version.
- collector/github-advisory-latest
- alias/GHSA-5x92-p4p5-33c4
- alias/CVE-2020-28348
- collector/nvd-index
- collector/nvd-cve
- agent/author
- agent/references
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/severity
- agent/weakness
- agent/last-modified-date
- agent/first-publish-date
- agent/description
- agent/event
- agent/tags
- agent/trending
- package-manager/go
- vendor/hashicorp
- canonical/hashicorp nomad
- version/hashicorp nomad/0.9.0
- version/hashicorp nomad/0.11.0
- version/hashicorp nomad/0.12.0