What is GHSA-77cr-6gr8-7rr9?

GHSA-77cr-6gr8-7rr9 is a security advisory published by GitHub Security Advisories with Critical severity. Use After Free in HashiCorp Nomad

Which CVE IDs does GHSA-77cr-6gr8-7rr9 cover?

GHSA-77cr-6gr8-7rr9 covers the following CVE IDs: CVE-2020-27195. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-77cr-6gr8-7rr9?

GHSA-77cr-6gr8-7rr9 has a CVSS v3 base score of 9.1, published by GitHub Security Advisories.

Which products are affected by GHSA-77cr-6gr8-7rr9?

GHSA-77cr-6gr8-7rr9 affects 3 products, including: go/github.com/hashicorp/nomad:\u003e= 0.9.0, \u003c 0.10.6; go/github.com/hashicorp/nomad:\u003e= 0.11.0, \u003c 0.11.5; go/github.com/hashicorp/nomad:\u003e= 0.12.0, \u003c 0.12.6.

GHSA-77cr-6gr8-7rr9CriticalCVSS 9.1

Use After Free in HashiCorp Nomad

Vendor

GitHub Security Advisories

Published

February 15, 2022

Last Modified

October 2, 2023

🔗 CVE IDs covered (1)

CVE-2020-27195 →

📋 Description

HashiCorp Nomad and Nomad Enterprise version 0.9.0 up to 0.12.5 client file sandbox feature can be subverted using either the template or artifact stanzas. Fixed in 0.12.6, 0.11.5, and 0.10.6

🎯 Affected products3

go/github.com/hashicorp/nomad:>= 0.9.0, < 0.10.6
go/github.com/hashicorp/nomad:>= 0.11.0, < 0.11.5
go/github.com/hashicorp/nomad:>= 0.12.0, < 0.12.6

🔗 References (6)

https://nvd.nist.gov/vuln/detail/CVE-2020-27195
https://github.com/hashicorp/nomad/issues/9129
https://github.com/hashicorp/nomad/pull/9139
https://github.com/hashicorp/nomad/blob/master/CHANGELOG.md#0126-october-21-2020
https://www.nomadproject.io/downloads
https://github.com/advisories/GHSA-77cr-6gr8-7rr9