SB2022021407 - Multiple vulnerabilities in Nomad

Description

This security bulletin contains information about 4 secuirty vulnerabilities.

1) Input validation error (CVE-ID: CVE-2022-24685)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient validation of user-supplied input within the HCL configuration. A remote authenticated attacker can perform a denial of service (DoS) attack.

2) Race condition (CVE-ID: CVE-2022-24686)

The vulnerability allows a remote attacker to compromise the target system.

The vulnerability exists due to a race condition in go-getter client. A remote attacker can exploit the race and download the wrong artifact into the wrong destination.

3) Input validation error (CVE-ID: CVE-2022-24684)

The vulnerability allows a remote attacker to compromise the target system.

The vulnerability exists due to insufficient validation of user-supplied input. A remote authenticated attacker can use the spread stanza in a way such that it can cause panic in Nomad servers.

4) Path traversal (CVE-ID: CVE-2022-24683)

The vulnerability allows a remote attacker to perform directory traversal attacks.

The vulnerability exists due to input validation error when processing directory traversal sequences. A remote authenticated attacker can send a specially crafted HTTP request and read arbitrary files on the system.

Remediation

Install update from vendor's website.

References

• https://github.com/hashicorp/nomad/releases/tag/v1.2.6
• https://github.com/hashicorp/nomad/issues/12036
• https://github.com/hashicorp/nomad/issues/12039