Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 812494 (CVE-2021-37218, CVE-2021-43415) - <sys-cluster/nomad-1.2.6: multiple vulnerabilities
Summary: <sys-cluster/nomad-1.2.6: multiple vulnerabilities
Status: RESOLVED FIXED
Alias: CVE-2021-37218, CVE-2021-43415
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All Linux
: Normal trivial
Assignee: Gentoo Security
URL: https://discuss.hashicorp.com/t/hcsec...
Whiteboard: ~4 [noglsa]
Keywords:
Depends on: CVE-2022-24683, CVE-2022-24684, CVE-2022-24685, CVE-2022-24686
Blocks:
  Show dependency tree
 
Reported: 2021-09-10 19:38 UTC by John Helmert III
Modified: 2022-02-20 19:54 UTC (History)
1 user (show)

See Also:
Package list:
Runtime testing required: ---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description John Helmert III archtester Gentoo Infrastructure gentoo-dev Security 2021-09-10 19:38:41 UTC 
CVE-2021-37218:

HashiCorp Nomad and Nomad Enterprise Raft RPC layer allows non-server agents with a valid certificate signed by the same CA to access server-only functionality, enabling privilege escalation. Fixed in 1.0.10 and 1.1.4.


Please bump.
Comment 1 John Helmert III archtester Gentoo Infrastructure gentoo-dev Security 2021-11-23 00:28:26 UTC 
From the 1.2.1 changelog (https://github.com/hashicorp/nomad/releases/tag/v1.2.1):

"Allow limiting QEMU arguments to reduce access to host resources. CVE-2021-43415 [GH-11542]"
Comment 2 Larry the Git Cow gentoo-dev 2022-02-15 17:40:30 UTC 
The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=c21bc0f0950d9fbacfcd7c008176e927c726ce7e

commit c21bc0f0950d9fbacfcd7c008176e927c726ce7e
Author:     William Hubbs <williamh@gentoo.org>
AuthorDate: 2022-02-15 17:36:40 +0000
Commit:     William Hubbs <williamh@gentoo.org>
CommitDate: 2022-02-15 17:39:50 +0000

    sys-cluster/nomad:  1.2.6 bump
    
    Bug: https://bugs.gentoo.org/812494
    Bug: https://bugs.gentoo.org/833157
    Package-Manager: Portage-3.0.30, Repoman-3.0.3
    Signed-off-by: William Hubbs <williamh@gentoo.org>

 sys-cluster/nomad/Manifest            |  2 ++
 sys-cluster/nomad/files/nomad.service | 29 +++++++++++++++++++++
 sys-cluster/nomad/nomad-1.2.6.ebuild  | 49 +++++++++++++++++++++++++++++++++++
 3 files changed, 80 insertions(+)
Comment 3 John Helmert III archtester Gentoo Infrastructure gentoo-dev Security 2022-02-15 22:24:17 UTC 
Please cleanup
Comment 4 Larry the Git Cow gentoo-dev 2022-02-20 18:53:05 UTC 
The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=010bb3a5ba073cc25e34ec9c001154e38aa7f789

commit 010bb3a5ba073cc25e34ec9c001154e38aa7f789
Author:     William Hubbs <williamh@gentoo.org>
AuthorDate: 2022-02-20 18:51:24 +0000
Commit:     William Hubbs <williamh@gentoo.org>
CommitDate: 2022-02-20 18:52:48 +0000

    sys-cluster/nomad: remove vulnerable versions
    
    Bug: https://bugs.gentoo.org/812494
    Bug: https://bugs.gentoo.org/833157
    Package-Manager: Portage-3.0.30, Repoman-3.0.3
    Signed-off-by: William Hubbs <williamh@gentoo.org>

 sys-cluster/nomad/Manifest           |  1 -
 sys-cluster/nomad/metadata.xml       |  1 -
 sys-cluster/nomad/nomad-1.0.9.ebuild | 45 ------------------------------------
 3 files changed, 47 deletions(-)
Comment 5 John Helmert III archtester Gentoo Infrastructure gentoo-dev Security 2022-02-20 19:54:14 UTC 
Thanks, all done!