Bug 846629 (CVE-2022-30324)

Summary:	<sys-cluster/nomad-1.2.13: vulnerability in bundled go-getter leads to client privilege escalation
Product:	Gentoo Security	Reporter:	John Helmert III <ajak>
Component:	Vulnerabilities	Assignee:	Gentoo Security <security>
Status:	RESOLVED FIXED
Severity:	trivial	CC:	williamh
Priority:	Normal
Version:	unspecified
Hardware:	All
OS:	Linux
URL:	https://github.com/hashicorp/nomad/issues/13057
Whiteboard:	~3 [noglsa]
Package list:		Runtime testing required:	---

Description John Helmert III archtester

2022-05-21 01:01:16 UTC

"A vulnerability was identified in the go-getter library that Nomad and Nomad Enterprise (“Nomad”) uses for its artifacts such that a specially crafted Nomad jobspec can be used for privilege escalation onto client agent hosts. This vulnerability affects Nomad versions 0.2.0 through 1.3.0, and is fixed in the 1.1.14, 1.2.8, and 1.3.1 releases."

Please bump to 1.2.8.

Comment 1 William Hubbs gentoo-dev

2022-10-26 19:30:15 UTC

This has been fixed in the tree.

Thanks,

William