medium6.5
CVE-2021-32575
Improper network isolation in Hashicorp Nomad
Impact
HashiCorp Nomad and Nomad Enterprise up to version 1.0.4 bridge networking mode allows ARP spoofing from other bridged tasks on the same node. Fixed in 0.12.12, 1.0.5, and 1.1.0 RC1.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| go | github.com/hashicorp/nomad | >= 1.0.0, < 1.0.5 | 1.0.5 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Hashicorp | Nomad | through 1.0.4 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://discuss.hashicorp.com/t/hcsec-2021-14-nomad-bridge-networking-mode-allows-arp-spoofing-from-other-bridged-tasks-on-same-node/24296
- https://www.hashicorp.com/blog/category/nomad
- https://github.com/advisories/GHSA-vf6q-9f2f-mwhv
- https://nvd.nist.gov/vuln/detail/CVE-2021-32575