CVE-2024-1329
08.02.2024, 20:15
HashiCorp Nomad and Nomad Enterprise 1.5.13 up to 1.6.6, and 1.7.3 template renderer is vulnerable to arbitrary file write on the host as the Nomad client user through symlink attacks. This vulnerability, CVE-2024-1329, is fixed in Nomad 1.7.4, 1.6.7, and 1.5.14.
| Vendor | Product | Version |
|---|---|---|
| hashicorp | nomad | 1.5.13 ≤ 𝑥 < 1.5.14 |
| hashicorp | nomad | 1.6.6 ≤ 𝑥 < 1.6.7 |
| hashicorp | nomad | 1.7.3. ≤ 𝑥 < 1.7.4 |
| hashicorp | nomad | 1.5.13 ≤ 𝑥 < 1.5.14 |
| hashicorp | nomad | 1.6.6 ≤ 𝑥 < 1.6.7 |
| hashicorp | nomad | 1.7.3. ≤ 𝑥 < 1.7.4 |
𝑥
= Vulnerable software versions
Ubuntu Releases
Common Weakness Enumeration
- CWE-59 - Improper Link Resolution Before File Access ('Link Following')The software attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.
- CWE-610 - Externally Controlled Reference to a Resource in Another SphereThe product uses an externally controlled name or reference that resolves to a resource that is outside of the intended control sphere.