CVE-2023-3299 - Nomad Caller ACL Token's Secret ID is Exposed to Sentinel

Back Back to CVE browser

LOW

Nomad Caller ACL Token's Secret ID is Exposed to Sentinel

Published Jul 19, 2023

3.4

LOW

CVSS 3.1

EPSS 0.60%

Description

HashiCorp Nomad Enterprise 1.2.11 up to 1.5.6, and 1.4.10 ACL policies using a block without a label generates unexpected results. Fixed in 1.6.0, 1.5.7, and 1.4.11.

Affected products

Vendor HashiCorp Product Nomad Enterprise Default
unaffected
- Version
  1.2.11
  Status
  affected
  Constraints
  <=1.4.10
- Version
  1.2.11
  Status
  affected
  Constraints
  <=1.5.6

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

HashiCorp

Nomad Enterprise

unaffected

Version	Status	Constraints
1.2.11	affected	<=1.4.10
1.2.11	affected	<=1.5.6

github.com/hashicorp/nomad

Go

Introduced 1.2.11 Fixed 1.4.11
github.com/hashicorp/nomad

Go

Introduced 1.5.0 Fixed 1.5.7

Ecosystem	Package	Introduced	Fixed
Go	github.com/hashicorp/nomad	1.2.11	1.4.11
Go	github.com/hashicorp/nomad	1.5.0	1.5.7

Remediation

No remediation recorded yet.

Weaknesses (2)

CWE-201

CWE-668

References (5)

Link	Providers	Tags
https://discuss.hashicorp.com/t/hcsec-2023-21-nomad-caller-acl-tokens-secret-id-is-exposed-to-sentinel/56271		Vendor Advisory
https://github.com/advisories/GHSA-9jfx-84v9-2rr2		Advisory
https://github.com/hashicorp/nomad/issues/17907
https://nvd.nist.gov/vuln/detail/CVE-2023-3299
https://pkg.go.dev/vuln/GO-2024-2669