CVE-2022-24686: Race Condition
Published Feb 14, 2022
·Updated
HashiCorp Nomad and Nomad Enterprise 0.3.0 through 1.0.17, 1.1.11, and 1.2.5 artifact download functionality has a race condition such that the Nomad client agent could download the wrong artifact into the wrong destination. Fixed in 1.0.18, 1.1.12, and 1.2.6
Affected Software
6 affected components
HashiCorp Nomad>=0.3.0<1.0.18
HashiCorp Nomad>=0.3.0<1.0.18
HashiCorp Nomad>=1.1.0<1.1.12
HashiCorp Nomad>=1.1.0<1.1.12
HashiCorp Nomad>=1.2.0<1.2.6
HashiCorp Nomad>=1.2.0<1.2.6
Event History
Feb 14, 2022
CVE Published
via MITRE·01:54 PM
Data Sourced
via MITRE·01:54 PM
Description
Frequently Asked Questions
1
What is the vulnerability ID?
The vulnerability ID is CVE-2022-24686.
2
What is the title of the vulnerability?
The title of the vulnerability is "HashiCorp Nomad and Nomad Enterprise 0.3.0 through 1.0.17, 1.1.11, and 1.2.5 artifact download functionality race condition".
3
What is the severity of CVE-2022-24686?
The severity of CVE-2022-24686 is medium with a severity value of 5.9.
4
Which software versions are affected by CVE-2022-24686?
HashiCorp Nomad and Nomad Enterprise versions 0.3.0 through 1.0.17, 1.1.11, and 1.2.5 are affected by CVE-2022-24686.
5
How can I fix CVE-2022-24686?
To fix CVE-2022-24686, update to HashiCorp Nomad and Nomad Enterprise versions 1.0.18, 1.1.12, or 1.2.6.