Moole Vulnerability Database

Find real vulnerabilities before they ship

Medium

CVE-2021-32575

HashiCorp Nomad and Nomad Enterprise up to version 1.0.4 bridge networking mode allows ARP spoofing from other bridged tasks on the same node. Fixed in 0.12.12, 1.0.5, and 1.1.0 RC1.

VectorADJACENT_NETWORK

PublishedJun 17, 2021, 19:15

Published Bycve@mitre.org

Base Score

Score6.5

Affected Versions

Package (Ecosystem)IntroducedFixedLimit

github.com/hashicorp/nomad(Go)1.0.01.0.5N/A

github.com/hashicorp/nomad(Go)00.12.12N/A

References

https://discuss.hashicorp.com/t/hcsec-2021-14-nomad-bridge-networking-mode-allows-arp-spoofing-from-other-bridged-tasks-on-same-node/24296
https://www.hashicorp.com/blog/category/nomad

Weakness Type

NVD-CWE-noinfo

CVSS Metrics

Base Score

6.5

Vector String

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Base SeverityMedium

Version

3.1

Attack Vector (AV)

ADJACENT_NETWORK