high8.8
CVE-2021-43415
Improper Authentication in HashiCorp Nomad
Impact
HashiCorp Nomad and Nomad Enterprise up to 1.0.13, 1.1.7, and 1.2.0, with the QEMU task driver enabled, allowed authenticated users with job submission capabilities to bypass the configured allowed image paths. Fixed in 1.0.14, 1.1.8, and 1.2.1.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| go | github.com/hashicorp/nomad | < 1.0.14 | 1.0.14 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Hashicorp | Nomad | from 1.0.0 before 1.0.14 from 1.1.0 before 1.1.8 Version 1.2.0 |