CVE-2023-3299: Nomad Caller ACL Token's Secret ID is Exposed to Sentinel
A vulnerability was identified in Nomad such that the API caller’s ACL token secret ID is exposed to Sentinel policies. This vulnerability, CVE-2023-3299, affects Nomad from 1.2.11 up to 1.5.6, and 1.4.10 and was fixed in 1.6.0, 1.5.7, and 1.4.11.
Other sources
HashiCorp Nomad Enterprise 1.2.11 up to 1.5.6, and 1.4.10 ACL policies using a block without a label generates unexpected results. Fixed in 1.6.0, 1.5.7, and 1.4.11.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
go/github.com/hashicorp/nomadto a version that resolves this vulnerability.Fixed in 1.5.7 - Upgrade
Upgrade
go/github.com/hashicorp/nomadto a version that resolves this vulnerability.Fixed in 1.4.11 - Upgrade
Upgrade
HashiCorp Nomadto a version that resolves this vulnerability.Fixed in 1.6.0 - Upgrade
Upgrade
HashiCorp Nomadto a version that resolves this vulnerability.Fixed in 1.5.7 - Upgrade
Upgrade
HashiCorp Nomadto a version that resolves this vulnerability.Fixed in 1.4.11
Event History
Frequently Asked Questions
What is the severity of CVE-2023-3299?
The severity of CVE-2023-3299 is low.
What is the vulnerability CVE-2023-3299 about?
CVE-2023-3299 is about an issue in HashiCorp Nomad Enterprise where ACL policies using a block without a label generate unexpected results.
Which versions of HashiCorp Nomad Enterprise are affected by CVE-2023-3299?
HashiCorp Nomad Enterprise versions 1.2.11 up to 1.5.6 and 1.4.10 are affected by CVE-2023-3299.
How can I fix CVE-2023-3299?
CVE-2023-3299 is fixed in HashiCorp Nomad Enterprise versions 1.6.0, 1.5.7, and 1.4.11. It is recommended to update to one of these versions.
Where can I find more information about CVE-2023-3299?
You can find more information about CVE-2023-3299 at the following link: [CVE-2023-3299](https://discuss.hashicorp.com/t/hcsec-2023-21-nomad-caller-acl-tokens-secret-id-is-exposed-to-sentinel/56271)