CVE-2023-1296 — Nomad ACLs Can Not Deny Access to Workload's Own Variables

CVE-2023-1296

Nomad ACLs Can Not Deny Access to Workload's Own Variables PUBLISHED

Description (CNA)

HashiCorp Nomad and Nomad Enterprise 1.4.0 up to 1.5.0 did not correctly enforce deny policies applied to a workload’s variables. Fixed in 1.4.6 and 1.5.1.

Affected (CNA)

Vendor / product	Versions
HashiCorp / Nomad	affected 1.5.0; affected 1.4.0 before 1.4.6
HashiCorp / Nomad Enterprise	affected 1.5.0; affected 1.4.0 before 1.4.6

CWE

CWE-682

References

https://discuss.hashicorp.com/t/hcsec-2023-09-nomad-acls-can-not-deny-access-to-workloads-own-variables/51390

ADP enrichment

CVE

No English description supplied.

https://discuss.hashicorp.com/t/hcsec-2023-09-nomad-acls-can-not-deny-access-to-workloads-own-variables/51390

CISA-ADP

No English description supplied.

No references supplied.