GHSA-6hv3-7c34-4hx8 CVE-2019-14802 GO-2022-0634
Hashicorp Nomad Information Exposure Through Environmental Variables
Medium
Go
- Severity
- 5.3 / 10
- Medium · CVSS 3.1
- Exploit chance (EPSS)
- 0.63%
- Chance of exploitation in the next 30 days. Higher than 50.12% of scored vulnerabilities.
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
- CWE-526 Cleartext Storage of Sensitive Information in an Environment Variable
- Fix
0.9.5- Upgrade github.com/hashicorp/nomad to this version or later
Description
In Nomad before version 0.9.5, when rendering a task template, all environment variables were available to the rendering task. As a fix, only task environment variables are used.
Affected versions
Go
| Package | Vulnerable | Fixed in |
|---|---|---|
| github.com/hashicorp/nomad | < 0.9.5 |
0.9.5 |
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
github.com/hashicorp/nomad Go → 0.9.5
- go
go get github.com/hashicorp/nomad@v0.9.5 && go mod tidy
Severity breakdown
CVSS 3.1 5.3
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- Attack vector
- Network
- Attack complexity
- Low
- Privileges required
- None
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- Low
- Integrity
- None
- Availability
- None
Weakness
CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
How to prevent it
- Architecture and Design: Compartmentalize the system to have "safe" areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area. Ensure that appropriate compartmentalization is built into the system design, and the compartmentalization allows for and reinforces privilege separation functionality. Architects and designers should rely on the principle of least privilege to decide the appropriate time to use privileges and the time to drop privileges.
CWE-526: Cleartext Storage of Sensitive Information in an Environment Variable
The product uses an environment variable to store unencrypted sensitive information.
How to prevent it
- Architecture and Design: Encrypt information stored in the environment variable to protect it from being exposed to an unauthorized user. If encryption is not feasible or is considered too expensive for the business use of the application, then consider using a properly protected configuration file instead of an environment variable. It should be understood that unencrypted information in a config file is also not guaranteed to be protected, but it is still a better choice, because it reduces attack surface related to weaknesses such as CWE-214. In some settings, vaults might be a feasible option for safer data transfer. Users should be notified of the business choice made to not protect the sensitive information through encryption.
- Implementation: If the environment variable is not necessary for the desired behavior, then remove it entirely, or clear it to an empty value.
References
Advisories
Packages
Other links
- github.com/hashicorp/nomad/pull/6055
- github.com/hashicorp/nomad/commit/e8238305ef0b9ef37be3efd86a8d34bfbed5f63f
- advisories.gitlab.com/advisory/advgo_github_com_hashicorp_nomad_client_allocrunner_taskrun…
- cve.mitre.org/cgi-bin/cvename.cgi
- github.com/hashicorp/nomad/releases/tag/v0.9.5
- hashicorp.com/blog/category/nomad
Timeline
- Published
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-hx53-77qj-8663 HashiCorp Nomad vulnerable to a path traversal | High | Also affects github.com/hashicorp/nomad |
| GHSA-3934-423w-4jq3 HashiCorp Nomad vulnerable to symlink attack | Medium | Also affects github.com/hashicorp/nomad |
| GHSA-rx97-6c62-55mf Hashicorp Nomad Incorrect Privilege Assignment vulnerability | High | Also affects github.com/hashicorp/nomad |
| GHSA-c3q9-q986-vrwh Nomad is vulnerable to unintentional exposure of the workload identity token and client secret token in audit logs | Medium | Also affects github.com/hashicorp/nomad |
| GHSA-hr68-hvgv-xxqf Hashicorp Nomad Incorrect Privilege Assignment vulnerability | Medium | Also affects github.com/hashicorp/nomad |
| GHSA-2w5v-x29g-jw7j Hashicorp Nomad Incorrect Authorization vulnerability | High | Also affects github.com/hashicorp/nomad |
| GHSA-25qx-vfw2-fw8r Nomad Vulnerable to Allocation Directory Escape On Non-Existing File Paths Through Archive Unpacking | Medium | Also affects github.com/hashicorp/nomad |
| GHSA-5mqx-rpxv-mvxj HashiCorp Nomad is vulnerable to path escape through archive unpacking during migration | High | Also affects github.com/hashicorp/nomad |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor