CVE-2024-1329: HashiCorp Nomad vulnerable to symlink attacks
(updated )
HashiCorp Nomad and Nomad Enterprise 1.5.13 up to 1.6.6, and 1.7.3 template renderer is vulnerable to arbitrary file write on the host as the Nomad client user through symlink attacks. Fixed in Nomad 1.7.4, 1.6.7, 1.5.14.
References
- discuss.hashicorp.com/t/hcsec-2024-03-nomad-vulnerable-to-arbitrary-write-through-symlink-attack
- github.com/advisories/GHSA-c866-8gpw-p3mv
- github.com/hashicorp/nomad
- github.com/hashicorp/nomad/commit/b3209cbc6921e703b0e9984ce70c10b378665834
- github.com/hashicorp/nomad/commit/d1721c7a6fc1833778086603f818a822a34f445a
- github.com/hashicorp/nomad/commit/de55da677a21ac7572c0f4a8cd9abd5473c47a70
- github.com/hashicorp/nomad/issues/19888
- nvd.nist.gov/vuln/detail/CVE-2024-1329
Detect and mitigate CVE-2024-1329 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →