UBUNTU-CVE-2024-7625

See a problem?
Please try reporting it to the source first.

Source

https://ubuntu.com/security/CVE-2024-7625

Import Source

https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2024/UBUNTU-CVE-2024-7625.json

JSON Data

https://api.osv.dev/v1/vulns/UBUNTU-CVE-2024-7625

Upstream

CVE-2024-7625

Published

2024-08-15T00:15:00Z

Modified

2025-10-24T05:06:46Z

Severity

5.8 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:N/I:H/A:N CVSS Calculator
Ubuntu - medium

Summary

[none]

Details

In HashiCorp Nomad and Nomad Enterprise from 0.6.1 up to 1.6.13, 1.7.10, and 1.8.2, the archive unpacking process is vulnerable to writes outside the allocation directory during migration of allocation directories when multiple archive headers target the same file. This vulnerability, CVE-2024-7625, is fixed in Nomad 1.6.14, 1.7.11, and 1.8.3. Access or compromise of the Nomad client agent at the source allocation first is a prerequisite for leveraging this vulnerability.

References

Affected packages

Ubuntu:18.04:LTS / nomad

Package

Name: nomad
Purl: pkg:deb/ubuntu/nomad@0.4.0+dfsg-1?arch=source&distro=bionic

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

0.*

0.4.0+dfsg-1

Ecosystem specific

{
    "binaries": [
        {
            "binary_name": "nomad",
            "binary_version": "0.4.0+dfsg-1"
        }
    ]
}

Database specific

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2024/UBUNTU-CVE-2024-7625.json"

Ubuntu:20.04:LTS / nomad