CVE-2022-24685

HIGH7.5EPSS 0.83%

HashiCorp Nomad vulnerable to Allocation of Resources Without Limits or Throttling

Published: 3/1/2022Modified: 8/21/2024

Also known as:GHSA-3382-r9q8-4hfgGO-2022-0577

Description

HashiCorp Nomad and Nomad Enterprise 1.x before 1.0.17, 1.1.x before 1.1.12, and 1.2.x before 1.2.6 is vulnerable to Allocation of Resources Without Limits or Throttling.

Affected packages (2)

Go/github.com/hashicorp/nomad>= 1.0.0, < 1.0.17
Go/github.com/hashicorp/nomad>= 1.0.0, < 1.0.17, >= 1.1.0, < 1.1.12, >= 1.2.0, < 1.2.6

CVSS scores

Source	Version	Severity	Vector
osv	CVSS 3.1	HIGH7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References (7)

ADVISORYhttps://github.com/advisories/GHSA-3382-r9q8-4hfg
ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2022-24685
PATCHgithub.com/hashicorp/nomad
WEBhttps://discuss.hashicorp.com
WEBhttps://discuss.hashicorp.com/t/hcsec-2022-03-nomad-malformed-job-parsing-results-in-excessive-cpu-usage
WEBhttps://discuss.hashicorp.com/t/hcsec-2022-03-nomad-malformed-job-parsing-results-in-excessive-cpu-usage/35561
WEBhttps://security.netapp.com/advisory/ntap-20220331-0007