CVE-2023-3300: Nomad Search API Leaks Information About CSI Plugins
First published: Wed Jul 19 2023(Updated: )
A vulnerability was identified in Nomad such that the search HTTP API can reveal names of available CSI plugins to unauthenticated users or users without the plugin:read policy. This vulnerability, CVE-2023-3300, affects Nomad since 0.11 and was fixed in 1.6.0, 1.5.7, and 1.4.11.
Credit: security@hashicorp.com security@hashicorp.com security@hashicorp.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| HashiCorp Nomad | >=0.11.0<=1.4.1 | |
| HashiCorp Nomad | >=0.11.0<=1.4.1 | |
| HashiCorp Nomad | >=1.5.0<=1.5.6 | |
| HashiCorp Nomad | >=1.5.0<=1.5.6 | |
| go/github.com/hashicorp/nomad | >=1.5.0<1.5.7 | 1.5.7 |
| go/github.com/hashicorp/nomad | >=0.11.0<1.4.11 | 1.4.11 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://discuss.hashicorp.com/t/hcsec-2023-22-nomad-search-api-leaks-information-about-csi-plugins/56272
- https://nvd.nist.gov/vuln/detail/CVE-2023-3300
- https://github.com/hashicorp/nomad/commit/a8789d3872bbf1b1f420f28b0f7ad8532a41d5e3
- https://pkg.go.dev/vuln/GO-2024-2671
- https://github.com/advisories/GHSA-v5fm-hr72-27hx (Advisory)
Frequently Asked Questions
What is CVE-2023-3300?
CVE-2023-3300 is a vulnerability in HashiCorp Nomad and Nomad Enterprise versions 0.11.0 up to 1.5.6 and 1.4.1, where the HTTP search API can reveal the names of available CSI plugins to unauthenticated users or users without the plugin:read policy.
How does the CVE-2023-3300 vulnerability affect HashiCorp Nomad?
The CVE-2023-3300 vulnerability affects HashiCorp Nomad versions 0.11.0 up to 1.5.6 and 1.4.1.
What is the severity of CVE-2023-3300?
CVE-2023-3300 has a severity rating of 5.3 (Medium).
How can I fix CVE-2023-3300 in HashiCorp Nomad?
To fix CVE-2023-3300 in HashiCorp Nomad, update to version 1.6.0, 1.5.7, or 1.4.1.
Where can I find more information about CVE-2023-3300?
You can find more information about CVE-2023-3300 at the following reference: [https://discuss.hashicorp.com/t/hcsec-2023-22-nomad-search-api-leaks-information-about-csi-plugins/56272](https://discuss.hashicorp.com/t/hcsec-2023-22-nomad-search-api-leaks-information-about-csi-plugins/56272)
- collector/nvd-latest
- collector/nvd-index
- agent/type
- agent/severity
- agent/author
- agent/description
- agent/softwarecombine
- agent/references
- agent/title
- agent/first-publish-date
- agent/event
- agent/weakness
- collector/github-advisory-latest
- source/GitHub
- alias/GHSA-v5fm-hr72-27hx
- alias/CVE-2023-3300
- agent/software-canonical-lookup
- collector/nvd-api
- source/NVD
- agent/tags
- collector/nvd-cve
- collector/github-advisory
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/trending
- vendor/hashicorp
- canonical/hashicorp nomad
- version/hashicorp nomad/1.5.0
- version/hashicorp nomad/1.5.6
- version/hashicorp nomad/0.11.0
- version/hashicorp nomad/1.4.1
- package-manager/go