What is GHSA-2jhh-5xm2-j4gf?

GHSA-2jhh-5xm2-j4gf is a security advisory published by GitHub Security Advisories with High severity. Improper Authentication in HashiCorp Nomad

Which CVE IDs does GHSA-2jhh-5xm2-j4gf cover?

GHSA-2jhh-5xm2-j4gf covers the following CVE IDs: CVE-2021-43415. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-2jhh-5xm2-j4gf?

GHSA-2jhh-5xm2-j4gf has a CVSS v3 base score of 8.8, published by GitHub Security Advisories.

Which products are affected by GHSA-2jhh-5xm2-j4gf?

GHSA-2jhh-5xm2-j4gf affects 3 products, including: go/github.com/hashicorp/nomad:\u003c 1.0.14; go/github.com/hashicorp/nomad:\u003e= 1.1.0, \u003c 1.1.8; go/github.com/hashicorp/nomad:\u003e= 1.2.0, \u003c 1.2.1.

GHSA-2jhh-5xm2-j4gfHighCVSS 8.8

Improper Authentication in HashiCorp Nomad

Vendor

GitHub Security Advisories

Published

December 10, 2021

Last Modified

February 1, 2023

🔗 CVE IDs covered (1)

CVE-2021-43415 →

📋 Description

HashiCorp Nomad and Nomad Enterprise up to 1.0.13, 1.1.7, and 1.2.0, with the QEMU task driver enabled, allowed authenticated users with job submission capabilities to bypass the configured allowed image paths. Fixed in 1.0.14, 1.1.8, and 1.2.1.

🎯 Affected products3

go/github.com/hashicorp/nomad:< 1.0.14
go/github.com/hashicorp/nomad:>= 1.1.0, < 1.1.8
go/github.com/hashicorp/nomad:>= 1.2.0, < 1.2.1

🔗 References (4)

https://nvd.nist.gov/vuln/detail/CVE-2021-43415
https://discuss.hashicorp.com/t/hcsec-2021-31-nomad-qemu-task-driver-allowed-paths-bypass-with-job-args/32288
https://www.hashicorp.com/blog/category/nomad
https://github.com/advisories/GHSA-2jhh-5xm2-j4gf