CVE-2023-0821: Uncontrolled Resource Consumption in Hashicorp Nomad

February 17, 2023

HashiCorp Nomad and Nomad Enterprise 1.2.15 up to 1.3.8, and 1.4.3 jobs using a maliciously compressed artifact stanza source can cause excessive disk usage. Fixed in 1.2.16, 1.3.9, and 1.4.4.

References

discuss.hashicorp.com/t/hcsec-2023-05-nomad-client-vulnerable-to-decompression-bombs-in-artifact-block/50292
github.com/advisories/GHSA-w479-w22g-cffh
nvd.nist.gov/vuln/detail/CVE-2023-0821

Detect and mitigate CVE-2023-0821 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →