GHSA-25qx-vfw2-fw8r

Source

https://github.com/advisories/GHSA-25qx-vfw2-fw8r

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/08/GHSA-25qx-vfw2-fw8r/GHSA-25qx-vfw2-fw8r.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-25qx-vfw2-fw8r

Aliases

CVE-2024-7625
GO-2024-3073

Published

2024-08-15T00:30:59Z

Modified

2024-09-25T19:27:54Z

Severity

5.8 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:N/I:H/A:N CVSS Calculator
4.6 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N CVSS Calculator

Summary

Nomad Vulnerable to Allocation Directory Escape On Non-Existing File Paths Through Archive Unpacking

Details

In HashiCorp Nomad and Nomad Enterprise from 0.6.1 up to 1.6.13, 1.7.10, and 1.8.2, the archive unpacking process is vulnerable to writes outside the allocation directory during migration of allocation directories when multiple archive headers target the same file. This vulnerability, CVE-2024-7625, is fixed in Nomad 1.6.14, 1.7.11, and 1.8.3. Access or compromise of the Nomad client agent at the source allocation first is a prerequisite for leveraging this vulnerability.

Database specific

{
    "nvd_published_at": "2024-08-15T00:15:13Z",
    "cwe_ids": [
        "CWE-610"
    ],
    "severity": "MODERATE",
    "github_reviewed": true,
    "github_reviewed_at": "2024-08-15T21:24:57Z"
}

References

Affected packages

Go / github.com/hashicorp/nomad

Package

Name: github.com/hashicorp/nomad; View open source insights on deps.dev
Purl: pkg:golang/github.com/hashicorp/nomad

Affected ranges

Type: SEMVER
Events: Introduced

0.6.1

Fixed

1.6.14

Go / github.com/hashicorp/nomad

Package

Name: github.com/hashicorp/nomad; View open source insights on deps.dev
Purl: pkg:golang/github.com/hashicorp/nomad

Affected ranges

Type: SEMVER
Events: Introduced

1.7.0

Fixed

1.7.11

Go / github.com/hashicorp/nomad

Package

Name: github.com/hashicorp/nomad; View open source insights on deps.dev
Purl: pkg:golang/github.com/hashicorp/nomad

Affected ranges

Type: SEMVER
Events: Introduced

1.8.0

Fixed

1.8.3