Detections
Analytics

Alpine: nomad: security update to 0.12.7-r0

critical Tenable Cloud Security Plugin ID 405857

Description

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

 - HashiCorp Nomad and Nomad Enterprise version 0.9.0 up to 0.12.5 client file sandbox feature can be
 subverted using either the template or artifact stanzas. Fixed in 0.12.6, 0.11.5, and 0.10.6
 (CVE-2020-27195)

 - HashiCorp Nomad and Nomad Enterprise 0.9.0 up to 0.12.7 client Docker file sandbox feature may be
 subverted when not explicitly disabled or when using a volume mount type. Fixed in 0.12.8, 0.11.7, and
 0.10.8. (CVE-2020-28348)

See Also

https://security.alpinelinux.org/vuln/CVE-2020-27195

https://security.alpinelinux.org/vuln/CVE-2020-28348

Plugin Details

Severity: Critical

ID: 405857

Version: Revision 1.25

Type: Local

Published: 10/31/2023

Updated: 3/13/2025

Supported Sensors: Agentless Assessment, Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Medium

Score: 4.3

Percentile: 53.04

CVSS v2

Risk Factor: Medium

Base Score: 6.4

Temporal Score: 4.7

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:N

CVSS Score Source: CVE-2020-27195

CVSS v3

Risk Factor: Critical

Base Score: 9.1

Temporal Score: 7.9

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Vulnerability Publication Date: 10/22/2020

Reference Information

CVE: CVE-2020-27195, CVE-2020-28348