2 lines
4.7 KiB
JSON
2 lines
4.7 KiB
JSON
{"affected":[{"affectedData":[{"defaultStatus":"unaffected","platforms":["64 bit","32 bit","x86","ARM","MacOS","Windows","Linux"],"product":"Nomad","repo":"https://github.com/hashicorp/nomad","vendor":"HashiCorp","versions":[{"lessThanOrEqual":"1.5.13","status":"affected","version":"0","versionType":"semver"},{"lessThanOrEqual":"1.6.6","status":"affected","version":"0","versionType":"semver"},{"lessThanOrEqual":"1.7.3","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","platforms":["64 bit","32 bit","x86","ARM","MacOS","Windows","Linux"],"product":"Nomad Enterprise","repo":"https://github.com/hashicorp/nomad","vendor":"HashiCorp","versions":[{"lessThanOrEqual":"1.5.13","status":"affected","version":"0","versionType":"semver"},{"lessThanOrEqual":"1.6.6","status":"affected","version":"0","versionType":"semver"},{"lessThanOrEqual":"1.7.3","status":"affected","version":"0","versionType":"semver"}]}],"source":"security@hashicorp.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:hashicorp:nomad:*:*:*:*:-:*:*:*","matchCriteriaId":"14F75343-9DC2-4C28-A571-7AC0BAEEA00A","versionEndExcluding":"1.5.14","versionStartIncluding":"1.5.13","vulnerable":true},{"criteria":"cpe:2.3:a:hashicorp:nomad:*:*:*:*:-:*:*:*","matchCriteriaId":"EC3377A1-FBDE-4E23-8F8F-E4520F594A8D","versionEndExcluding":"1.6.7","versionStartIncluding":"1.6.6","vulnerable":true},{"criteria":"cpe:2.3:a:hashicorp:nomad:*:*:*:*:-:*:*:*","matchCriteriaId":"EF7459A5-A515-478C-AC04-51674B63357B","versionEndExcluding":"1.7.4","versionStartIncluding":"1.7.3.","vulnerable":true}],"negate":false,"operator":"OR"}]},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:hashicorp:nomad:*:*:*:*:enterprise:*:*:*","matchCriteriaId":"AC798750-00B8-446C-8ABC-104F4BCF4C77","versionEndExcluding":"1.5.14","versionStartIncluding":"1.5.13","vulnerable":true},{"criteria":"cpe:2.3:a:hashicorp:nomad:*:*:*:*:enterprise:*:*:*","matchCriteriaId":"34BF7182-EA1A-4C8E-9C90-3F03A177E6DF","versionEndExcluding":"1.6.7","versionStartIncluding":"1.6.6","vulnerable":true},{"criteria":"cpe:2.3:a:hashicorp:nomad:*:*:*:*:enterprise:*:*:*","matchCriteriaId":"E250A18C-5782-45C8-867C-477719DDA393","versionEndExcluding":"1.7.4","versionStartIncluding":"1.7.3.","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"HashiCorp Nomad and Nomad Enterprise 1.5.13 up to 1.6.6, and 1.7.3 template renderer is vulnerable to arbitrary file write on the host as the Nomad client user through symlink attacks. This vulnerability, CVE-2024-1329, is fixed in Nomad 1.7.4, 1.6.7, and 1.5.14."},{"lang":"es","value":"HashiCorp Nomad y Nomad Enterprise 1.5.13 hasta 1.6.6 y 1.7.3 el renderizador de plantillas es vulnerable a la escritura de archivos arbitrarios en el host como usuario del cliente Nomad a través de ataques de enlaces simbólicos. Corregido en Nomad 1.7.4, 1.6.7, 1.5.14."}],"id":"CVE-2024-1329","lastModified":"2026-06-17T07:03:59.630","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.7,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:N/I:H/A:H","version":"3.1"},"exploitabilityScore":1.3,"impactScore":5.8,"source":"security@hashicorp.com","type":"Secondary"},{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2024-1329","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2024-07-17T19:54:48.732815Z","version":"2.0.3"}}]},"published":"2024-02-08T20:15:52.643","references":[{"source":"security@hashicorp.com","tags":["Vendor Advisory"],"url":"https://discuss.hashicorp.com/t/hcsec-2024-03-nomad-vulnerable-to-arbitrary-write-through-symlink-attack"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"],"url":"https://discuss.hashicorp.com/t/hcsec-2024-03-nomad-vulnerable-to-arbitrary-write-through-symlink-attack"}],"sourceIdentifier":"security@hashicorp.com","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-59"}],"source":"security@hashicorp.com","type":"Secondary"},{"description":[{"lang":"en","value":"CWE-610"}],"source":"nvd@nist.gov","type":"Primary"}]}
|