CVE-2024-6717

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2024-6717

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-6717.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2024-6717

Aliases

Downstream

Related

Published

2024-07-23T00:16:20Z

Modified

2026-10-22T02:47:38Z

Severity

7.7 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N CVSS Calculator

Summary

Nomad Vulnerable to Allocation Directory Path Escape Through Archive Unpacking

Details

HashiCorp Nomad and Nomad Enterprise 1.6.12 up to 1.7.9, and 1.8.1 archive unpacking during migration is vulnerable to path escaping of the allocation directory. This vulnerability, CVE-2024-6717, is fixed in Nomad 1.6.13, 1.7.10, and 1.8.2.

Database specific

{
    "cna_assigner":  "HashiCorp",
    "cwe_ids":  [
        "CWE-610"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/6xxx/CVE-2024-6717.json"
}

References

Affected packages

Git / github.com/hashicorp/nomad

Affected ranges

Type

GIT

Repo

https://github.com/hashicorp/nomad

Events

Introduced

Fixed

7f0822c1e4f25907d9f60e2d595411950dd1bd28

Fixed

de10efa3fa3b72ccf0cde9a9b0eb1c9ed0cd309d

Database specific

Show details

{
    "extracted_events":  [
        {
            "range":  [
                {
                    "introduced":  "0"
                },
                {
                    "fixed":  "1.8.2"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StandardRange"
        },
        {
            "range":  [
                {
                    "introduced":  "0"
                },
                {
                    "fixed":  "1.6.13"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "ChangesAt"
        }
    ]
}

Affected versions

Other

show

v0.*

v0.0.0

v0.1.0

v0.1.1

v0.1.2

v0.10.0-beta1

v0.2.0

v0.2.1

v0.2.2

v0.2.3

v0.2.3-rc1

v0.3.0-rc2

v0.3.1

v0.3.2

v0.3.2-rc1

v0.3.2-rc2

v0.3rc1

v0.4.0

v0.4.0-rc1

v0.4.0-rc2

v0.4.1

v0.4.1-rc1

v0.5.0

v0.5.0-rc1

v0.5.0-rc2

v0.5.1

v0.5.1-rc1

v0.5.1-rc2

v0.5.2

v0.5.2-rc1

v0.5.3

v0.5.5

v0.5.5-rc1

v0.5.5-rc2

v0.5.6

v0.5.6-rc1

v0.6.0

v0.6.0-rc1

v0.6.0-rc2

v0.6.1

v0.6.2

v0.6.3-rc1

v0.7.0

v0.7.0-rc1

v0.7.0-rc2

v0.7.0-rc3

v0.7.1

v0.7.1+pro

v0.7.1-rc1

v0.7.1-rc1+pro

v0.8.0

v0.8.0+pro

v0.8.0-rc1

v0.8.0-rc1+pro

v0.8.2

v0.8.3

v0.8.4

v0.8.4-rc1

v0.9.0

v0.9.0-beta1

v0.9.0-beta2

v0.9.0-beta3

v0.9.0-rc1

v0.9.0-rc2

v0.9.2

v0.9.2-rc1

v0.9.3

v0.9.4

v0.9.4-rc1

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-6717.json"