high7.7
CVE-2024-6717
HashiCorp Nomad is vulnerable to path escape through archive unpacking during migration
Impact
HashiCorp Nomad and Nomad Enterprise 1.6.12 up to 1.7.9, and 1.8.1 archive unpacking during migration is vulnerable to path escaping of the allocation directory. This vulnerability, CVE-2024-6717, is fixed in Nomad 1.6.13, 1.7.10, and 1.8.2.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| go | github.com/hashicorp/nomad | < 1.8.2 | 1.8.2 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Hashicorp | Nomad | from 1.7.0 before 1.7.10 Versions 1.6.12, 1.8.1 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://discuss.hashicorp.com/t/hcsec-2024-15-nomad-vulnerable-to-allocation-directory-path-escape-through-archive-unpacking/68781
- https://github.com/advisories/GHSA-5mqx-rpxv-mvxj
- https://nvd.nist.gov/vuln/detail/CVE-2024-6717
- https://github.com/hashicorp/nomad/commit/ef6cdec8847e0698d386d1fd3761743df758ef99
- https://github.com/hashicorp/nomad/releases/tag/v1.8.2