CVE-2024-1329: Nomad Vulnerable to Arbitrary Write Through Symlink Attack
First published: Thu Feb 08 2024(Updated: )
HashiCorp Nomad and Nomad Enterprise 1.5.13 up to 1.6.6, and 1.7.3 template renderer is vulnerable to arbitrary file write on the host as the Nomad client user through symlink attacks. Fixed in Nomad 1.7.4, 1.6.7, 1.5.14.
Credit: security@hashicorp.com security@hashicorp.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| go/github.com/hashicorp/nomad | =1.7.3 | 1.7.4 |
| go/github.com/hashicorp/nomad | >=1.6.0<=1.6.6 | 1.6.7 |
| go/github.com/hashicorp/nomad | =1.5.13 | 1.5.14 |
| HashiCorp Nomad | >=1.5.13<1.5.14 | |
| HashiCorp Nomad | >=1.6.6<1.6.7 | |
| HashiCorp Nomad | >=1.7.3.<1.7.4 | |
| HashiCorp Nomad | >=1.5.13<1.5.14 | |
| HashiCorp Nomad | >=1.6.6<1.6.7 | |
| HashiCorp Nomad | >=1.7.3.<1.7.4 | |
| >=1.5.13<1.5.14 | ||
| >=1.6.6<1.6.7 | ||
| >=1.7.3.<1.7.4 | ||
| >=1.5.13<1.5.14 | ||
| >=1.6.6<1.6.7 | ||
| >=1.7.3.<1.7.4 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://discuss.hashicorp.com/t/hcsec-2024-03-nomad-vulnerable-to-arbitrary-write-through-symlink-attack
- https://nvd.nist.gov/vuln/detail/CVE-2024-1329
- https://github.com/hashicorp/nomad/issues/19888
- https://github.com/hashicorp/nomad/commit/b3209cbc6921e703b0e9984ce70c10b378665834
- https://github.com/hashicorp/nomad/commit/d1721c7a6fc1833778086603f818a822a34f445a
- https://github.com/hashicorp/nomad/commit/de55da677a21ac7572c0f4a8cd9abd5473c47a70
- https://github.com/advisories/GHSA-c866-8gpw-p3mv (Advisory)
- agent/title
- agent/type
- agent/first-publish-date
- collector/epss-latest
- source/FIRST
- agent/epss
- agent/references
- agent/author
- agent/severity
- agent/tags
- collector/mitre-cve
- source/MITRE
- agent/weakness
- agent/description
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- collector/github-advisory-latest
- source/GitHub
- alias/GHSA-c866-8gpw-p3mv
- alias/CVE-2024-1329
- agent/last-modified-date
- agent/softwarecombine
- agent/event
- collector/nvd-cve
- collector/github-advisory
- agent/trending
- vendor/hashicorp
- canonical/hashicorp nomad
- version/hashicorp nomad/1.5.13
- version/hashicorp nomad/1.6.6
- version/hashicorp nomad/1.7.3.
- package-manager/go