Detections
Analytics

CVE-2024-7625

medium

Description

In HashiCorp Nomad and Nomad Enterprise from 0.6.1 up to 1.6.13, 1.7.10, and 1.8.2, the archive unpacking process is vulnerable to writes outside the allocation directory during migration of allocation directories when multiple archive headers target the same file. This vulnerability, CVE-2024-7625, is fixed in Nomad 1.6.14, 1.7.11, and 1.8.3. Access or compromise of the Nomad client agent at the source allocation first is a prerequisite for leveraging this vulnerability.

References

https://discuss.hashicorp.com/t/hcsec-2024-17-nomad-vulnerable-to-allocation-directory-escape-on-non-existing-file-paths-through-archive-unpacking/69293

Details

Source: Mitre, NVD

Published: 2024-08-15

Updated: 2024-09-25

Risk Information

CVSS v2

Base Score: 4.6

Vector: CVSS2#AV:N/AC:H/Au:M/C:N/I:C/A:N

Severity: Medium

CVSS v3

Base Score: 5.8

Vector: CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:C/C:N/I:H/A:N

Severity: Medium

CVSS v4

Base Score: 4.6

Vector: CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N

Severity: Medium

EPSS

EPSS: 0.00103