GHSA-gwmc-6795-qghjMediumCVSS 5.9

HashiCorp Nomad Artifact Download Race Condition

Published
February 15, 2022
Last Modified
February 3, 2023

🔗 CVE IDs covered (1)

CVE-2022-24686 →

📋 Description

HashiCorp Nomad and Nomad Enterprise 0.3.0 through 1.0.17, 1.1.11, and 1.2.5 artifact download functionality has a race condition such that the Nomad client agent could download the wrong artifact into the wrong destination. This issue is fixed in 1.0.18, 1.1.12, and 1.2.6.

🎯 Affected products3

  • go/github.com/hashicorp/nomad:>= 0.3.0, < 1.0.18
  • go/github.com/hashicorp/nomad:>= 1.1.0, < 1.1.12
  • go/github.com/hashicorp/nomad:>= 1.2.0, < 1.2.6

🔗 References (7)