Vulnerability Description
HashiCorp Nomad and Nomad Enterprise 1.4.0 up to 1.5.0 did not correctly enforce deny policies applied to a workload’s variables. Fixed in 1.4.6 and 1.5.1.
CVSS Score
2.7
LOW
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Hashicorp | Nomad | >= 1.4.0, < 1.4.6 |
Related Weaknesses (CWE)
References
- https://discuss.hashicorp.com/t/hcsec-2023-09-nomad-acls-can-not-deny-access-to-Issue TrackingVendor Advisory
- https://discuss.hashicorp.com/t/hcsec-2023-09-nomad-acls-can-not-deny-access-to-Issue TrackingVendor Advisory
FAQ
What is CVE-2023-1296?
CVE-2023-1296 is a vulnerability with a CVSS score of 2.7 (LOW). HashiCorp Nomad and Nomad Enterprise 1.4.0 up to 1.5.0 did not correctly enforce deny policies applied to a workload’s variables. Fixed in 1.4.6 and 1.5.1.
How severe is CVE-2023-1296?
CVE-2023-1296 has been rated LOW with a CVSS base score of 2.7/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2023-1296?
Check the references section above for vendor advisories and patch information. Affected products include: Hashicorp Nomad.