CVE-2020-28348: Path Traversal
HashiCorp Nomad and Nomad Enterprise 0.9.0 up to 0.12.7 client Docker file sandbox feature (github.com/hashicorp/nomad/drivers/docker) may be subverted when not explicitly disabled or when using a volume mount type. Fixed in 0.12.8, 0.11.7, and 0.10.8.
Other sources
HashiCorp Nomad and Nomad Enterprise 0.9.0 up to 0.12.7 client Docker file sandbox feature may be subverted when not explicitly disabled or when using a volume mount type. Fixed in 0.12.8, 0.11.7, and 0.10.8.
Affected Software
Event History
Frequently Asked Questions
What is the vulnerability ID for this issue?
The vulnerability ID is CVE-2020-28348.
What is the severity rating of CVE-2020-28348?
The severity rating of CVE-2020-28348 is medium (6.5).
How can the Nomad client Docker file sandbox feature be subverted?
The Nomad client Docker file sandbox feature can be subverted when not explicitly disabled or when using a volume mount type.
What versions of HashiCorp Nomad and Nomad Enterprise are affected by this vulnerability?
HashiCorp Nomad and Nomad Enterprise versions 0.9.0 up to 0.12.7 are affected.
How can I fix the vulnerability?
You can fix the vulnerability by updating to version 0.12.8, 0.11.7, or 0.10.8 of HashiCorp Nomad, depending on your current version.