What is GHSA-c8x3-rg72-fwwg?

GHSA-c8x3-rg72-fwwg is a security advisory published by GitHub Security Advisories with High severity. Privilege escalation in Hashicorp Nomad

Which CVE IDs does GHSA-c8x3-rg72-fwwg cover?

GHSA-c8x3-rg72-fwwg covers the following CVE IDs: CVE-2021-37218. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-c8x3-rg72-fwwg?

GHSA-c8x3-rg72-fwwg has a CVSS v3 base score of 8.8, published by GitHub Security Advisories.

Which products are affected by GHSA-c8x3-rg72-fwwg?

GHSA-c8x3-rg72-fwwg affects 2 products, including: go/github.com/hashicorp/nomad:\u003c 1.0.10; go/github.com/hashicorp/nomad:\u003e= 1.1.0, \u003c 1.1.4.

GHSA-c8x3-rg72-fwwgHighCVSS 8.8

Privilege escalation in Hashicorp Nomad

Vendor

GitHub Security Advisories

Published

September 8, 2021

Last Modified

February 1, 2023

🔗 CVE IDs covered (1)

CVE-2021-37218 →

📋 Description

HashiCorp Nomad and Nomad Enterprise Raft RPC layer allows non-server agents with a valid certificate signed by the same CA to access server-only functionality, enabling privilege escalation. Fixed in 1.0.10 and 1.1.4.

🎯 Affected products2

go/github.com/hashicorp/nomad:< 1.0.10
go/github.com/hashicorp/nomad:>= 1.1.0, < 1.1.4

🔗 References (4)

https://nvd.nist.gov/vuln/detail/CVE-2021-37218
https://discuss.hashicorp.com/t/hcsec-2021-21-nomad-raft-rpc-privilege-escalation/29023
https://www.hashicorp.com/blog/category/nomad
https://github.com/advisories/GHSA-c8x3-rg72-fwwg