Skip to content
CVE PROGRAM SOURCE RECORD2.7 Low

CVE-2023-1296

Nomad ACLs Can Not Deny Access to Workload's Own Variables

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
HashiCorp

Description

HashiCorp Nomad and Nomad Enterprise 1.4.0 up to 1.5.0 did not correctly enforce deny policies applied to a workload’s variables. Fixed in 1.4.6 and 1.5.1.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

HashiCorp Nomad

Default version status: unaffected

  • 1.5.0affected
  • 1.4.0 to < 1.4.6affected

HashiCorp Nomad Enterprise

Default version status: unaffected

  • 1.5.0affected
  • 1.4.0 to < 1.4.6affected

References