critical9.1
CVE-2020-27195
Use After Free in HashiCorp Nomad
Impact
HashiCorp Nomad and Nomad Enterprise version 0.9.0 up to 0.12.5 client file sandbox feature can be subverted using either the template or artifact stanzas. Fixed in 0.12.6, 0.11.5, and 0.10.6
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| go | github.com/hashicorp/nomad | >= 0.9.0, < 0.10.6 | 0.10.6 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Hashicorp | Nomad | from 0.9.0 through 0.10.5 from 0.11.0 through 0.11.4 from 0.12.0 through 0.12.5 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/hashicorp/nomad/blob/master/CHANGELOG.md#0126-october-21-2020
- https://www.nomadproject.io/downloads
- https://github.com/advisories/GHSA-77cr-6gr8-7rr9
- https://nvd.nist.gov/vuln/detail/CVE-2020-27195
- https://github.com/hashicorp/nomad/issues/9129
- https://github.com/hashicorp/nomad/pull/9139