GHSA-6hv3-7c34-4hx8
Suggest an improvement- Source
- https://github.com/advisories/GHSA-6hv3-7c34-4hx8
- Import Source
- https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/02/GHSA-6hv3-7c34-4hx8/GHSA-6hv3-7c34-4hx8.json
- JSON Data
- https://api.osv.dev/v1/vulns/GHSA-6hv3-7c34-4hx8
- Aliases
- Published
- 2022-02-15T01:57:18Z
- Modified
- 2024-08-21T15:42:03.991769Z
- Severity
-
- 5.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N CVSS Calculator
- Summary
- Hashicorp Nomad Information Exposure Through Environmental Variables
- Details
-
In Nomad before version 0.9.5, when rendering a task template, all environment variables were available to the rendering task. As a fix, only task environment variables are used.
- Database specific
{ "nvd_published_at": "2022-12-26T21:15:00Z", "severity": "MODERATE", "cwe_ids": [ "CWE-200", "CWE-526" ], "github_reviewed_at": "2021-05-12T17:59:46Z", "github_reviewed": true }- References
-
- https://nvd.nist.gov/vuln/detail/CVE-2019-14802
- https://github.com/hashicorp/nomad/pull/6055
- https://github.com/hashicorp/nomad/commit/e8238305ef0b9ef37be3efd86a8d34bfbed5f63f
- https://advisories.gitlab.com/advisory/advgo_github_com_hashicorp_nomad_client_allocrunner_taskrunner_template_GMS_2022_818.html
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-14802
- https://github.com/hashicorp/nomad
- https://github.com/hashicorp/nomad/releases/tag/v0.9.5
- https://www.hashicorp.com/blog/category/nomad
Affected packages
Go / github.com/hashicorp/nomad
Package
- Name
- github.com/hashicorp/nomad
- View open source insights on deps.dev
- Purl
- pkg:golang/github.com/hashicorp/nomad