CVE-2022-30324: Critical severity HashiCorp Nomad vulnerability
HashiCorp Nomad and Nomad Enterprise version 0.2.0 up to 1.3.0 were impacted by go-getter vulnerabilities enabling privilege escalation through the artifact stanza in submitted jobs onto the client agent host. Fixed in 1.1.14, 1.2.8, and 1.3.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
alpine/nomadto a version that resolves this vulnerability.Fixed in 1.1.14-r0 - Upgrade
Upgrade
alpine/nomadto a version that resolves this vulnerability.Fixed in 1.3.1-r0 - Upgrade
Upgrade
HashiCorp Nomad and Nomad Enterpriseto a version that resolves this vulnerability.Fixed in 1.1.14 - Upgrade
Upgrade
HashiCorp Nomad and Nomad Enterpriseto a version that resolves this vulnerability.Fixed in 1.2.8 - Upgrade
Upgrade
HashiCorp Nomad and Nomad Enterpriseto a version that resolves this vulnerability.Fixed in 1.3.1
Event History
Frequently Asked Questions
What is the vulnerability ID for this HashiCorp Nomad vulnerability?
The vulnerability ID for this HashiCorp Nomad vulnerability is CVE-2022-30324.
What is the severity of CVE-2022-30324?
The severity of CVE-2022-30324 is critical with a CVSS score of 9.8.
How can privilege escalation be achieved through the vulnerability?
Privilege escalation can be achieved through the artifact stanza in submitted jobs onto the client agent host.
Which versions of HashiCorp Nomad and Nomad Enterprise are affected by the vulnerability?
HashiCorp Nomad and Nomad Enterprise versions 0.2.0 up to 1.3.0 are affected by the vulnerability.
How can I fix CVE-2022-30324?
The vulnerability is fixed in HashiCorp Nomad versions 1.1.14, 1.2.8, and 1.3.1.