CVE-2021-37218: High severity HashiCorp Nomad vulnerability
HashiCorp Nomad and Nomad Enterprise Raft RPC layer allows non-server agents with a valid certificate signed by the same CA to access server-only functionality, enabling privilege escalation. Fixed in 1.0.10 and 1.1.4.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
HashiCorp Nomad and Nomad Enterpriseto a version that resolves this vulnerability.Fixed in 1.0.10 - Upgrade
Upgrade
HashiCorp Nomad and Nomad Enterpriseto a version that resolves this vulnerability.Fixed in 1.1.4
Event History
Frequently Asked Questions
What is CVE-2021-37218?
CVE-2021-37218 is a vulnerability in HashiCorp Nomad and Nomad Enterprise that allows non-server agents with a valid certificate to access server-only functionality, enabling privilege escalation.
How severe is CVE-2021-37218?
CVE-2021-37218 has a severity score of 8.8, which is considered high.
How can I fix CVE-2021-37218?
To fix CVE-2021-37218, update to version 1.0.10 or 1.1.4 of HashiCorp Nomad or Nomad Enterprise.
Is HashiCorp Nomad affected by CVE-2021-37218?
Yes, HashiCorp Nomad versions up to and including 1.0.10 are affected by CVE-2021-37218.
Where can I find more information about CVE-2021-37218?
You can find more information about CVE-2021-37218 on the HashiCorp discussion forum and the HashiCorp blog.