GHSA-gwmc-6795-qghj
Suggest an improvement- Source
- https://github.com/advisories/GHSA-gwmc-6795-qghj
- Import Source
- https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/02/GHSA-gwmc-6795-qghj/GHSA-gwmc-6795-qghj.json
- JSON Data
- https://api.osv.dev/v1/vulns/GHSA-gwmc-6795-qghj
- Aliases
- Published
- 2022-02-15T00:02:46Z
- Modified
- 2024-08-21T15:41:50.046177Z
- Severity
-
- 5.9 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N CVSS Calculator
- Summary
- HashiCorp Nomad Artifact Download Race Condition
- Details
-
HashiCorp Nomad and Nomad Enterprise 0.3.0 through 1.0.17, 1.1.11, and 1.2.5 artifact download functionality has a race condition such that the Nomad client agent could download the wrong artifact into the wrong destination. This issue is fixed in 1.0.18, 1.1.12, and 1.2.6.
- Database specific
{ "github_reviewed": true, "severity": "MODERATE", "github_reviewed_at": "2022-03-18T18:21:52Z", "nvd_published_at": "2022-02-14T14:15:00Z", "cwe_ids": [ "CWE-362" ] }- References
-
- https://nvd.nist.gov/vuln/detail/CVE-2022-24686
- https://github.com/hashicorp/nomad/issues/12036
- https://discuss.hashicorp.com
- https://discuss.hashicorp.com/t/hcsec-2022-01-nomad-artifact-download-race-condition/35559
- https://github.com/hashicorp/nomad
- https://github.com/hashicorp/nomad/releases/tag/v1.2.6
- https://security.netapp.com/advisory/ntap-20220318-0008
Affected packages
Go / github.com/hashicorp/nomad
Package
- Name
- github.com/hashicorp/nomad
- View open source insights on deps.dev
- Purl
- pkg:golang/github.com/hashicorp/nomad
Go / github.com/hashicorp/nomad
Package
- Name
- github.com/hashicorp/nomad
- View open source insights on deps.dev
- Purl
- pkg:golang/github.com/hashicorp/nomad
Go / github.com/hashicorp/nomad
Package
- Name
- github.com/hashicorp/nomad
- View open source insights on deps.dev
- Purl
- pkg:golang/github.com/hashicorp/nomad