CVE-2023-3300
Fixed upstream EPSS <1%CVSS 5.3
HashiCorp Nomad and Nomad Enterprise 0.11.0 up to 1.5.6 and 1.4.1 HTTP search API can reveal names of available CSI plugins to unauthenticated users or users without the plugin:read policy. Fixed in 1.6.0, 1.5.7, and 1.4.1.
Products: HashiCorp Nomad, HashiCorp Nomad Enterprise
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Go | github.com/hashicorp/nomad | 1.4.11 |
| Go | github.com/hashicorp/nomad | 1.5.7 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu:18.04:LTS | nomad | no fix |
| Ubuntu:20.04:LTS | nomad | no fix |