Description
HashiCorp Nomad and Nomad Enterprise 1.5.13 up to 1.6.6, and 1.7.3 template renderer is vulnerable to arbitrary file write on the host as the Nomad client user through symlink attacks. This vulnerability, CVE-2024-1329, is fixed in Nomad 1.7.4, 1.6.7, and 1.5.14.
CVSS Metrics
- Vector
- CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:N/I:H/A:H
- Attack Vector
- network
- Complexity
- high
- Privileges
- high
- User Action
- none
- Scope
- changed
- Confidentiality
- none
- Integrity
- high
- Availability
- high
- Weaknesses
- CWE-59CWE-610
Metadata
- Primary Vendor
- HASHICORP
- Published
- 2/8/2024
- Last Modified
- 11/21/2024
- Source
- NIST NVD
- Note: Verify all details with official vendor sources before applying patches.
Affected Products
hashicorp : nomadhashicorp : nomadhashicorp : nomadhashicorp : nomadhashicorp : nomadhashicorp : nomad
AI-Powered Remediation
Generate remediation guidance or a C-suite brief for this vulnerability.