CVE-2024-6717: Nomad Vulnerable to Allocation Directory Path Escape Through Archive Unpacking
Published Jul 23, 2024
·Updated
HashiCorp Nomad and Nomad Enterprise 1.6.12 up to 1.7.9, and 1.8.1 archive unpacking during migration is vulnerable to path escaping of the allocation directory. This vulnerability, CVE-2024-6717, is fixed in Nomad 1.6.13, 1.7.10, and 1.8.2.
Affected Software
8 affected components
HashiCorp Nomad>=1.6.12<1.7.9, <=1.8.1
HashiCorp Nomad Enterprise>=1.6.12<1.7.9, <=1.8.1
HashiCorp Nomad>=1.7.0<1.7.10
HashiCorp Nomad>=1.7.0<1.7.10
HashiCorp Nomad=1.6.12
HashiCorp Nomad=1.6.12
HashiCorp Nomad=1.8.1
HashiCorp Nomad=1.8.1
Event History
Jul 23, 2024
CVE Published
via MITRE·12:16 AM
Data Sourced
via MITRE·12:16 AM
DescriptionSeverityWeakness
Data Sourced
via NVD·01:15 AM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2024-6717?
CVE-2024-6717 is considered a moderate severity vulnerability due to the potential for path escaping during archive unpacking.
2
How do I fix CVE-2024-6717?
To fix CVE-2024-6717, upgrade to Nomad version 1.6.13, 1.7.10, or 1.8.2.
3
What systems are affected by CVE-2024-6717?
CVE-2024-6717 affects HashiCorp Nomad and Nomad Enterprise versions 1.6.12 through 1.7.9 and 1.8.1.
4
What kind of attack does CVE-2024-6717 enable?
CVE-2024-6717 enables attackers to perform a path escape attack, potentially compromising the allocation directory.
5
When was CVE-2024-6717 disclosed?
CVE-2024-6717 was disclosed in 2024 and affects certain versions of HashiCorp Nomad.