Skip to content
OpenAdvisories

Package · Alpine

nomad

22 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

9 results · Clear filters · Feed

  • High 7.5
    CVE-2023-24534

    Excessive memory allocation in net/http and net/textproto

    HTTP and MIME header parsing can allocate large amounts of memory, even when parsing small inputs, potentially leading to a denial of service. Certain unusual patterns of input data can cause the common function used to parse HTTP and MIME headers to allocate…

    Go standard library net/textproto go stdlib Debian Ubuntu Alpine Go
  • High 7.4
    CVE-2023-1299

    Nomad Job Submitter Privilege Escalation Using Workload Identity

    HashiCorp Nomad and Nomad Enterprise 1.5.0 allow a job submitter to escalate to management-level privileges using workload identity and task API. Fixed in 1.5.1.

    HashiCorp Nomad Enterprise Nomad nomad Ubuntu Alpine Go
  • High 7.5
    CVE-2022-24685

    HashiCorp Nomad vulnerable to Allocation of Resources Without Limits or Throttling

    HashiCorp Nomad and Nomad Enterprise 1.0.17, 1.1.11, and 1.2.5 allow invalid HCL for the jobs parse endpoint, which may cause excessive CPU usage. Fixed in 1.0.18, 1.1.12, and 1.2.6.

    nomad github.com/hashicorp/nomad nomad Ubuntu Alpine Go
  • High 7.5
    CVE-2022-24683

    Arbitrary file reads in HashiCorp Nomad

    HashiCorp Nomad and Nomad Enterprise 0.9.2 through 1.0.17, 1.1.11, and 1.2.5 allow operators with read-fs and alloc-exec (or job-submit) capabilities to read arbitrary files on the host filesystem as root.

    nomad github.com/hashicorp/nomad nomad Ubuntu Alpine Go
  • High 7.5
    CVE-2021-44716

    golang.org/x/net/http2 allows uncontrolled memory consumption

    net/http in Go before 1.16.12 and 1.17.x before 1.17.5 allows uncontrolled memory consumption in the header canonicalization cache via HTTP/2 requests.

    go stdlib golang-1.8 golang.org/x/net Debian Ubuntu Alpine Go
  • High 8.8
    CVE-2021-43415

    Improper Authentication in HashiCorp Nomad

    HashiCorp Nomad and Nomad Enterprise up to 1.0.13, 1.1.7, and 1.2.0, with the QEMU task driver enabled, allowed authenticated users with job submission capabilities to bypass the configured allowed image paths. Fixed in 1.0.14, 1.1.8, and 1.2.1.

    nomad github.com/hashicorp/nomad nomad Ubuntu Alpine Go
  • High 8.8
    CVE-2021-37218

    Privilege escalation in Hashicorp Nomad

    HashiCorp Nomad and Nomad Enterprise Raft RPC layer allows non-server agents with a valid certificate signed by the same CA to access server-only functionality, enabling privilege escalation. Fixed in 1.0.10 and 1.1.4.

    nomad github.com/hashicorp/nomad nomad Ubuntu Alpine Go
  • High 7.5
    CVE-2021-3283

    Improper Privilege Management in HashiCorp Nomad

    HashiCorp Nomad and Nomad Enterprise up to 0.12.9 exec and java task drivers can access processes associated with other tasks on the same node. Fixed in 0.12.10, and 1.0.3.

    nomad github.com/hashicorp/nomad nomad Ubuntu Alpine Go
  • High 7.5
    CVE-2020-7218

    Allocation of Resources Without Limits or Throttling in HashiCorp Nomad

    HashiCorp Nomad and Nonad Enterprise up to 0.10.2 HTTP/RPC services allowed unbounded resource usage, and were susceptible to unauthenticated denial of service. Fixed in 0.10.3.

    nomad github.com/hashicorp/nomad nomad Ubuntu Alpine Go