GHSA-9jfx-84v9-2rr2 CVE-2023-3299 GO-2024-2669
Nomad Caller ACL Token’s Secret ID is Exposed to Sentinel
- Severity
- 3.4 / 10
- Low · CVSS 3.1
- Exploit chance (EPSS)
- 0.60%
- Chance of exploitation in the next 30 days. Higher than 48.71% of scored vulnerabilities.
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- CWE-201 Insertion of Sensitive Information Into Sent Data
- CWE-668 Exposure of Resource to Wrong Sphere
- Fix
1.4.11- Upgrade github.com/hashicorp/nomad to this version or later
Description
A vulnerability was identified in Nomad such that the API caller’s ACL token secret ID is exposed to Sentinel policies. This vulnerability, CVE-2023-3299, affects Nomad from 1.2.11 up to 1.5.6, and 1.4.10 and was fixed in 1.6.0, 1.5.7, and 1.4.11.
Affected versions
Go
| Package | Vulnerable | Fixed in |
|---|---|---|
| github.com/hashicorp/nomad | >= 1.2.11, < 1.4.11 |
1.4.11 |
| github.com/hashicorp/nomad | >= 1.5.0, < 1.5.7 |
1.5.7 |
| github.com/hashicorp/nomad | >= 1.2.11, < 1.4.11>= 1.5.0, < 1.5.7 |
1.4.111.5.7 |
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
github.com/hashicorp/nomad Go → 1.4.11
- go
go get github.com/hashicorp/nomad@v1.4.11 && go mod tidy
Severity breakdown
CVSS 3.1 3.4
CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N
- Attack vector
- Adjacent
- Attack complexity
- Low
- Privileges required
- High
- User interaction
- None
- Scope
- Changed
- Confidentiality
- Low
- Integrity
- None
- Availability
- None
Weakness
CWE-201: Insertion of Sensitive Information Into Sent Data
The code transmits data to another actor, but a portion of the data includes sensitive information that should not be accessible to that actor.
How to prevent it
- Requirements: Specify which data in the software should be regarded as sensitive. Consider which types of users should have access to which types of data.
- Implementation: Ensure that any possibly sensitive data specified in the requirements is verified with designers to ensure that it is either a calculated risk or mitigated elsewhere. Any information that is not necessary to the functionality should be removed in order to lower both the overhead and the possibility of security sensitive data being sent.
- System Configuration: Setup default error messages so that unexpected errors do not disclose sensitive information.
- Architecture and Design: Compartmentalize the system to have "safe" areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area. Ensure that appropriate compartmentalization is built into the system design, and the compartmentalization allows for and reinforces privilege separation functionality. Architects and designers should rely on the principle of least privilege to decide the appropriate time to use privileges and the time to drop privileges.
CWE-668: Exposure of Resource to Wrong Sphere
The product exposes a resource to the wrong control sphere, providing unintended actors with inappropriate access to the resource.
References
Advisories
Packages
Other links
Timeline
- Published
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-hx53-77qj-8663 HashiCorp Nomad vulnerable to a path traversal | High | Also affects github.com/hashicorp/nomad |
| GHSA-3934-423w-4jq3 HashiCorp Nomad vulnerable to symlink attack | Medium | Also affects github.com/hashicorp/nomad |
| GHSA-rx97-6c62-55mf Hashicorp Nomad Incorrect Privilege Assignment vulnerability | High | Also affects github.com/hashicorp/nomad |
| GHSA-c3q9-q986-vrwh Nomad is vulnerable to unintentional exposure of the workload identity token and client secret token in audit logs | Medium | Also affects github.com/hashicorp/nomad |
| GHSA-hr68-hvgv-xxqf Hashicorp Nomad Incorrect Privilege Assignment vulnerability | Medium | Also affects github.com/hashicorp/nomad |
| GHSA-2w5v-x29g-jw7j Hashicorp Nomad Incorrect Authorization vulnerability | High | Also affects github.com/hashicorp/nomad |
| GHSA-25qx-vfw2-fw8r Nomad Vulnerable to Allocation Directory Escape On Non-Existing File Paths Through Archive Unpacking | Medium | Also affects github.com/hashicorp/nomad |
| GHSA-5mqx-rpxv-mvxj HashiCorp Nomad is vulnerable to path escape through archive unpacking during migration | High | Also affects github.com/hashicorp/nomad |
Credits: anonymous4ACL24
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor