CVE-2021-37218

Name
CVE-2021-37218
Description
HashiCorp Nomad and Nomad Enterprise Raft RPC layer allows non-server agents with a valid certificate signed by the same CA to access server-only functionality, enabling privilege escalation. Fixed in 1.0.10 and 1.1.4.
NVD Severity
high
Other trackers
Mailing lists
Exploits
Forges
GitHub (code, issues), Aports (code, issues)

References

Type URI
MISC https://discuss.hashicorp.com/t/hcsec-2021-21-nomad-raft-rpc-privilege-escalation/29023
MISC https://www.hashicorp.com/blog/category/nomad

Match rules

CPE URI Source package Min version Max version
cpe:2.3:a:hashicorp:nomad:*:*:*:*:-:*:*:* nomad >= None < 1.0.10
cpe:2.3:a:hashicorp:nomad:*:*:*:*:-:*:*:* nomad >= 1.1.1 < 1.1.4

Vulnerable and fixed packages

Source package Branch Version Maintainer Status
nomad 3.14-community 1.0.4-r2 Matthias Neugebauer <mtneug@mailbox.org> possibly vulnerable
nomad edge-community 1.1.1-r2 Matthias Neugebauer <mtneug@mailbox.org> possibly vulnerable