1 line
1.8 KiB
JSON
1 line
1.8 KiB
JSON
{"schema_version":"1.9.0","id":"GHSA-hhvx-8755-4cvw","published":"2023-07-06T19:24:11Z","modified":"2024-08-20T20:58:32.766064Z","aliases":["CVE-2023-1296","GO-2023-1899"],"summary":"Hashicorp Nomad ACLs Cannot Deny Access to Workload’s Own Variables","details":"A vulnerability was identified in Nomad and Nomad Enterprise (“Nomad”) such that a deny ACL capability could not be applied to a workload’s own variables. If included, the Nomad ACL system will silently fail to block access. This vulnerability, CVE-2023-1296, was fixed in Nomad 1.4.6 and 1.5.1.","affected":[{"package":{"name":"github.com/hashicorp/nomad","ecosystem":"Go","purl":"pkg:golang/github.com/hashicorp/nomad"},"ranges":[{"type":"SEMVER","events":[{"introduced":"1.4.0"},{"fixed":"1.4.6"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/07/GHSA-hhvx-8755-4cvw/GHSA-hhvx-8755-4cvw.json"}},{"package":{"name":"github.com/hashicorp/nomad","ecosystem":"Go","purl":"pkg:golang/github.com/hashicorp/nomad"},"ranges":[{"type":"SEMVER","events":[{"introduced":"1.5.0"},{"fixed":"1.5.1"}]}],"versions":["1.5.0"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/07/GHSA-hhvx-8755-4cvw/GHSA-hhvx-8755-4cvw.json"}}],"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-1296"},{"type":"WEB","url":"https://discuss.hashicorp.com/t/hcsec-2023-09-nomad-acls-can-not-deny-access-to-workloads-own-variables/51390"},{"type":"PACKAGE","url":"https://github.com/hashicorp/nomad"}],"database_specific":{"cwe_ids":[],"github_reviewed":true,"github_reviewed_at":"2023-07-06T21:54:20Z","nvd_published_at":"2023-03-14T15:15:00Z","severity":"MODERATE"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"}]} |