CVE-2024-6717
Fixed in a distro release EPSS <1%CVSS 7.7
HashiCorp Nomad and Nomad Enterprise 1.6.12 up to 1.7.9, and 1.8.1 archive unpacking during migration is vulnerable to path escaping of the allocation directory. This vulnerability, CVE-2024-6717, is fixed in Nomad 1.6.13, 1.7.10, and 1.8.2.
Products: HashiCorp Nomad, HashiCorp Nomad Enterprise
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Go | github.com/hashicorp/nomad | 1.8.2 |
| Go | github.com/hashicorp/nomad | 1.11.1 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu 18.04 LTS | nomad | no fix |
| Ubuntu 20.04 LTS | nomad | no fix |
| openSUSE Leap 15.6 | govulncheck-vulndb | 0.0.20260114T191543-150000.1.137.1 |
| openSUSE Leap 16.0 | govulncheck-vulndb | 0.0.20260723T184607-160000.1.1 |