Skip to content
OpenAdvisories
High · 7.5 CVE-2022-24685 EUVD-2022-1281GHSA-3382-r9q8-4hfgGO-2022-0577

HashiCorp Nomad vulnerable to Allocation of Resources Without Limits or Throttling

Published Feb 28, 2022 · Updated Aug 3, 2024 · Assigned by mitre

Package: github.com/hashicorp/nomad Package: nomad Package: nomad Ecosystem: Alpine Ecosystem: Go Ecosystem: Ubuntu

Description

HashiCorp Nomad and Nomad Enterprise 1.0.17, 1.1.11, and 1.2.5 allow invalid HCL for the jobs parse endpoint, which may cause excessive CPU usage. Fixed in 1.0.18, 1.1.12, and 1.2.6.

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 20.04 LTS nomad No fix yet —
Ubuntu 18.04 LTS nomad No fix yet —

Alpine

Security tracker ↗
ReleasePackageFixed inAdvisory
Alpine v3.18 nomad 1.2.6-r0 —
Alpine v3.17 nomad 1.2.6-r0 —
Alpine v3.16 nomad 1.2.6-r0 —
Alpine v3.15 nomad 1.1.12-r0 —

Affected packages

EcosystemPackageAffectedFixedRecord
Go github.com/hashicorp/nomad >= 1.0.0, < 1.0.17 1.0.17 GHSA-3382-r9q8-4hfg
Go github.com/hashicorp/nomad >= 1.1.0, < 1.1.12 1.1.12 GHSA-3382-r9q8-4hfg
Go github.com/hashicorp/nomad >= 1.2.0, < 1.2.6 1.2.6 GHSA-3382-r9q8-4hfg
Go github.com/hashicorp/nomad >= 1.0.0, < 1.0.17 · >= 1.1.0, < 1.1.12 · >= 1.2.0, < 1.2.6 1.0.17, 1.1.12, 1.2.6 GO-2022-0577

References