Moole Vulnerability Database

Find real vulnerabilities before they ship

Critical

CVE-2020-27195

HashiCorp Nomad and Nomad Enterprise version 0.9.0 up to 0.12.5 client file sandbox feature can be subverted using either the template or artifact stanzas. Fixed in 0.12.6, 0.11.5, and 0.10.6

VectorNETWORK

PublishedOct 22, 2020, 17:15

Published Bycve@mitre.org

Base Score

Score9.1

Affected Versions

Package (Ecosystem)IntroducedFixedLimit

github.com/hashicorp/nomad(Go)0.9.00.10.6N/A

github.com/hashicorp/nomad(Go)0.11.00.11.5N/A

github.com/hashicorp/nomad(Go)0.12.00.12.6N/A

References

https://github.com/hashicorp/nomad/blob/master/CHANGELOG.md#0126-october-21-2020
https://www.nomadproject.io/downloads

Weakness Type

NVD-CWE-noinfo

CVSS Metrics

Base Score

9.1

Vector String

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Base SeverityCritical

Version

3.1

Attack Vector (AV)

NETWORK