Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
32 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
HashiCorp Nomad and Nomad Enterprise 0.3.0 through 1.0.17, 1.1.11, and 1.2.5 artifact download functionality has a race condition such that the Nomad client agent could download the wrong artifact into the wrong destination. This issue is fixed in 1.0.18, 1.1.12, and 1.2.6.
Recommended action: Upgrade to 1.2.6, 1.1.12 or 1.0.18 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
HashiCorp Nomad and Nomad Enterprise up to 1.0.13, 1.1.7, and 1.2.0, with the QEMU task driver enabled, allowed authenticated users with job submission capabilities to bypass the configured allowed image paths. Fixed in 1.0.14, 1.1.8, and 1.2.1.
Recommended action: Upgrade to 1.2.1, 1.1.8 or 1.0.14 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Go github.com/hashicorp/nomad < 1.0.10; >= 1.1.0, < 1.1.4
Fixed in
1.0.101.1.4· Vendor fix available
Issue
HashiCorp Nomad and Nomad Enterprise Raft RPC layer allows non-server agents with a valid certificate signed by the same CA to access server-only functionality, enabling privilege escalation. Fixed in 1.0.10 and 1.1.4.
Recommended action: Upgrade to 1.1.4 or 1.0.10 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Go github.com/hashicorp/nomad >= 1.0.0, < 1.0.3; < 0.12.10
Fixed in
0.12.101.0.3· Vendor fix available
Issue
HashiCorp Nomad and Nomad Enterprise up to 0.12.9 exec and java task drivers can access processes associated with other tasks on the same node. Fixed in 0.12.10, and 1.0.3.
Recommended action: Upgrade to 1.0.3 or 0.12.10 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Go github.com/hashicorp/nomad >= 1.0.0, < 1.0.5; < 0.12.12
Fixed in
0.12.121.0.5· Vendor fix available
Issue
HashiCorp Nomad and Nomad Enterprise up to version 1.0.4 bridge networking mode allows ARP spoofing from other bridged tasks on the same node. Fixed in 0.12.12, 1.0.5, and 1.1.0 RC1.
Recommended action: Upgrade to 1.0.5 or 0.12.12 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
HashiCorp Nomad and Nomad Enterprise up to 0.10.2 incorrectly validated role/region associated with TLS certificates used for mTLS RPC, and were susceptible to privilege escalation. Fixed in 0.10.3.
Recommended action: Upgrade to 0.10.3 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
HashiCorp Nomad and Nomad Enterprise before 0.10.3 allow unbounded resource usage. Specific Go Packages Affected github.com/hashicorp/nomad/command/agent
Recommended action: Upgrade to 0.10.3 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.