What is GHSA-vf6q-9f2f-mwhv?

GHSA-vf6q-9f2f-mwhv is a security advisory published by GitHub Security Advisories with Medium severity. Improper network isolation in Hashicorp Nomad

Which CVE IDs does GHSA-vf6q-9f2f-mwhv cover?

GHSA-vf6q-9f2f-mwhv covers the following CVE IDs: CVE-2021-32575. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-vf6q-9f2f-mwhv?

GHSA-vf6q-9f2f-mwhv has a CVSS v3 base score of 6.5, published by GitHub Security Advisories.

Which products are affected by GHSA-vf6q-9f2f-mwhv?

GHSA-vf6q-9f2f-mwhv affects 2 products, including: go/github.com/hashicorp/nomad:\u003e= 1.0.0, \u003c 1.0.5; go/github.com/hashicorp/nomad:\u003c 0.12.12.

GHSA-vf6q-9f2f-mwhvMediumCVSS 6.5

Improper network isolation in Hashicorp Nomad

Vendor

GitHub Security Advisories

Published

June 24, 2021

Last Modified

February 1, 2023

🔗 CVE IDs covered (1)

CVE-2021-32575 →

📋 Description

HashiCorp Nomad and Nomad Enterprise up to version 1.0.4 bridge networking mode allows ARP spoofing from other bridged tasks on the same node. Fixed in 0.12.12, 1.0.5, and 1.1.0 RC1.

🎯 Affected products2

go/github.com/hashicorp/nomad:>= 1.0.0, < 1.0.5
go/github.com/hashicorp/nomad:< 0.12.12

🔗 References (4)

https://nvd.nist.gov/vuln/detail/CVE-2021-32575
https://discuss.hashicorp.com/t/hcsec-2021-14-nomad-bridge-networking-mode-allows-arp-spoofing-from-other-bridged-tasks-on-same-node/24296
https://www.hashicorp.com/blog/category/nomad
https://github.com/advisories/GHSA-vf6q-9f2f-mwhv