Description
HashiCorp Nomad 0.5.0 through 0.9.4 (fixed in 0.9.5) reveals unintended environment variables to the rendering task during template rendering, aka GHSA-6hv3-7c34-4hx8. This applies to nomad/client/allocrunner/taskrunner/template.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 20.04 LTS | nomad | No fix yet | — |
| Ubuntu 18.04 LTS | nomad | No fix yet | — |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.18 | nomad | 0.9.5-r0 | — |
| Alpine v3.17 | nomad | 0.9.5-r0 | — |
| Alpine v3.16 | nomad | 0.9.5-r0 | — |
| Alpine v3.15 | nomad | 0.9.5-r0 | — |
| Alpine v3.14 | nomad | 0.9.5-r0 | — |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.13 | nomad | 0.9.5-r0 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Go | github.com/hashicorp/nomad | < 0.9.5 | 0.9.5 | GHSA-6hv3-7c34-4hx8 |