CVE-2022-3866

Fixed upstream EPSS <1%CVSS 5.0

HashiCorp Nomad and Nomad Enterprise 1.4.0 up to 1.4.1 workload identity token can list non-sensitive metadata for paths under nomad/ that belong to other jobs in the same namespace. Fixed in 1.4.2.

Published 2022-11-10 · CVE record · OSV

Products: HashiCorp Nomad, HashiCorp Nomad Enterprise

Fixed upstream

Ecosystem	Package	Fixed in
Go	github.com/hashicorp/nomad	1.4.2

Distro releases

Release	Package	Fixed in
Ubuntu 18.04 LTS	nomad	no fix
Ubuntu 20.04 LTS	nomad	no fix