~ / search / GHSA-6jm6-cmcp-fqjq

GHSA-6jm6-cmcp-fqjq

Nomad Spread Job Stanza May Trigger Panic in Servers

Source: GitHub Advisory Database (reviewed) Moderate CVE-2022-24684

Packages

EcosystemPackageAffectedFixed in
Go github.com/hashicorp/nomad >= 0.9.0, < 1.0.18 1.0.18
Go github.com/hashicorp/nomad >= 1.1.0, < 1.1.12 1.1.12
Go github.com/hashicorp/nomad >= 1.2.0, < 1.2.6 1.2.6

Details

As written in the advisory (Markdown source, shown as plain text).

Nomad and Nomad Enterprise allows operators with job-submit capabilities to use the spread stanza in a way such that it can cause panic in Nomad servers. This vulnerability, CVE-2022-24684, was fixed in Nomad 1.0.18, 1.1.12, and 1.2.6.

References

External links from the advisory. They lead to third-party sites.