CVE-2022-3866 — Nomad Workload Identity Token Can List Non-sensitive Metadata for Paths Under nomad/

CVE-2022-3866

Nomad Workload Identity Token Can List Non-sensitive Metadata for Paths Under nomad/ PUBLISHED

Description (CNA)

HashiCorp Nomad and Nomad Enterprise 1.4.0 up to 1.4.1 workload identity token can list non-sensitive metadata for paths under nomad/ that belong to other jobs in the same namespace. Fixed in 1.4.2.

Affected (CNA)

Vendor / product	Versions
HashiCorp / Nomad	affected 1.4.0; affected 1.4.1
HashiCorp / Nomad Enterprise	affected 1.4.0; affected 1.4.1

CWE

CWE-668

References

https://discuss.hashicorp.com/t/hcsec-2022-25-nomad-s-workload-identity-token-can-list-non-sensitive-metadata-for-nomad-paths/46167

ADP enrichment

CVE

No English description supplied.

https://discuss.hashicorp.com/t/hcsec-2022-25-nomad-s-workload-identity-token-can-list-non-sensitive-metadata-for-nomad-paths/46167

CISA-ADP

No English description supplied.

No references supplied.