HashiCorp Nomad and Nomad Enterprise version 0.2.0 up to 1.3.0 were impacted by go-getter vulnerabilities enabling privilege escalation through the artifact stanza in submitted jobs onto the client agent host. Fixed in 1.1.14, 1.2.8, and 1.3.1.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - HashiCorp Nomad and Nomad Enterprise version 0.2.0 up to 1.3.0 were impacted by go-getter vulnerabilities     enabling privilege escalation through the artifact stanza in submitted jobs onto the client agent host.
    Fixed in 1.1.14, 1.2.8, and 1.3.1. (CVE-2022-30324)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - HashiCorp Nomad and Nomad Enterprise version 0.2.0 up to 1.3.0 were impacted by go-getter vulnerabilities
    enabling privilege escalation through the artifact stanza in submitted jobs onto the client agent host.
    Fixed in 1.1.14, 1.2.8, and 1.3.1. (CVE-2022-30324)

ID	Name	Product	Family	Type	Severity
262290	Linux Distros Unpatched Vulnerability : CVE-2022-30324	Nessus	Misc.	Local	critical
410498	SCA: security update for github.com/hashicorp/nomad (GHSA-526x-rm7j-v389)	Tenable Cloud Security	SCA Checks	Local	critical
410498	SCA: security update for github.com/hashicorp/nomad (GHSA-526x-rm7j-v389)	Tenable Self-Hosted Container Security	SCA Checks	Local	critical
405866	Alpine: nomad: security update to 1.3.1-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	Local	critical
405866	Alpine: nomad: security update to 1.3.1-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	Local	critical
405864	Alpine: nomad: security update to 1.1.14-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	Local	critical
405864	Alpine: nomad: security update to 1.1.14-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	Local	critical

Detections

Analytics

CVE-2022-30324

critical

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical