Description
HashiCorp Nomad and Nomad Enterprise 0.3.0 through 1.0.17, 1.1.11, and 1.2.5 artifact download functionality has a race condition such that the Nomad client agent could download the wrong artifact into the wrong destination. Fixed in 1.0.18, 1.1.12, and 1.2.6
References (3)
Core 3
Core References
Vendor Advisory x_refsource_misc
https://discuss.hashicorp.com
Vendor Advisory x_refsource_misc
https://discuss.hashicorp.com/t/hcsec-2022-01-nomad-artifact-download-race-condition/35559
Third Party Advisory x_refsource_confirm
https://security.netapp.com/advisory/ntap-20220318-0008/
Scores
CVSS v3
5.9
EPSS
0.0036
EPSS Percentile
57.9%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
Details
CWE
CWE-362
Status
published
Products (2)
hashicorp/nomad
0.3.0 - 1.0.18 (2 CPE variants)
hashicorp/nomad
0.3.0 - 1.0.18Go
Published
Feb 14, 2022
Tracked Since
Feb 18, 2026