CVE-2022-3867 — Nomad Event Stream Subscriber Using a Token with TTL Receives Updates Until Garbage Collected

CVE-2022-3867

Nomad Event Stream Subscriber Using a Token with TTL Receives Updates Until Garbage Collected PUBLISHED

Description (CNA)

HashiCorp Nomad and Nomad Enterprise 1.4.0 up to 1.4.1 event stream subscribers using a token with TTL receive updates until token garbage is collected. Fixed in 1.4.2.

Affected (CNA)

Vendor / product	Versions
HashiCorp / Nomad	affected 1.4.0; affected 1.4.1
HashiCorp / Nomad Enterprise	affected 1.4.0; affected 1.4.1

CWE

CWE-613

References

https://discuss.hashicorp.com/t/hcsec-2022-26-nomad-s-event-stream-subscriber-using-acl-token-with-ttl-receive-updates-until-garbage-collected/46168

ADP enrichment

CVE

No English description supplied.

https://discuss.hashicorp.com/t/hcsec-2022-26-nomad-s-event-stream-subscriber-using-acl-token-with-ttl-receive-updates-until-garbage-collected/46168

CISA-ADP

No English description supplied.

No references supplied.