CVE-2023-3299

Description

A vulnerability exists in Nomad where the API caller's ACL token secret ID is exposed to Sentinel policies.

Affected packages (2)

• Go/github.com/hashicorp/nomad>= 1.2.11, < 1.4.11
• Go/github.com/hashicorp/nomad>= 1.2.11, < 1.4.11, >= 1.5.0, < 1.5.7

CVSS scores

References (5)

• ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2023-3299
• PATCHhttps://github.com/hashicorp/nomad
• WEBhttps://discuss.hashicorp.com/t/hcsec-2023-21-nomad-caller-acl-tokens-secret-id-is-exposed-to-sentinel/56271
• WEBhttps://github.com/hashicorp/nomad/issues/17907
• WEBhttps://pkg.go.dev/vuln/GO-2024-2669