Skip to content

x/vulndb: potential Go vuln in github.com/hashicorp/nomad: GHSA-2w2v-xcr9-mj4m #1928

New issue

Have a question about this project? # for a free GitHub account to open an issue and contact its maintainers and the community.

#

By clicking “#”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? # to your account

Jump to bottom
Closed
GoVulnBot opened this issue Jul 15, 2023 · 3 comments
Closed

x/vulndb: potential Go vuln in github.com/hashicorp/nomad: GHSA-2w2v-xcr9-mj4m #1928

GoVulnBot opened this issue Jul 15, 2023 · 3 comments
Assignees
@neild
Labels
excluded: EFFECTIVELY_PRIVATE This vulnerability exists in a package can be imported, but isn't meant to be outside that module.

Comments

@GoVulnBot
Copy link

In GitHub Security Advisory GHSA-2w2v-xcr9-mj4m, there is a vulnerability in the following Go packages or modules:

Unit Fixed Vulnerable Ranges
github.com/hashicorp/nomad 0.9.2 >= 0.9.0, <= 0.9.1

Cross references:

See doc/triage.md for instructions on how to triage this report.

modules:
    - module: github.com/hashicorp/nomad
      versions:
        - introduced: TODO (earliest fixed "0.9.2", vuln range ">= 0.9.0, <= 0.9.1")
      vulnerable_at: 1.5.6
      packages:
        - package: github.com/hashicorp/nomad
summary: Hashicorp Nomad Access Control Issues
description: |-
    HashiCorp Nomad 0.9.0 through 0.9.1 has Incorrect Access Control via the exec
    driver.
cves:
    - CVE-2019-12618
ghsas:
    - GHSA-2w2v-xcr9-mj4m
references:
    - web: https://nvd.nist.gov/vuln/detail/CVE-2019-12618
    - report: https://github.com/hashicorp/nomad/issues/5783
    - web: https://www.hashicorp.com/blog/category/nomad
    - web: https://www.hashicorp.com/blog/hashicorp-nomad-0-9-2
    - advisory: https://github.com/advisories/GHSA-2w2v-xcr9-mj4m
@neild neild self-assigned this Jul 25, 2023
@neild neild added the excluded: EFFECTIVELY_PRIVATE This vulnerability exists in a package can be imported, but isn't meant to be outside that module. label Jul 25, 2023
@gopherbot
Copy link
Contributor

Change https://go.dev/cl/513195 mentions this issue: data/excluded: batch add 26 excluded reports

@GoVulnBot GoVulnBot mentioned this issue Feb 9, 2024
Closed
This was referenced Apr 1, 2024
Closed
Closed
Closed
@gopherbot
Copy link
Contributor

Change https://go.dev/cl/592761 mentions this issue: data/reports: unexclude 75 reports

@GoVulnBot GoVulnBot mentioned this issue Aug 15, 2024
Closed
@gopherbot
Copy link
Contributor

Change https://go.dev/cl/606788 mentions this issue: data/reports: unexclude 20 reports (8)

gopherbot pushed a commit that referenced this issue Aug 20, 2024
@tatianab @gopherbot
data/reports: unexclude 20 reports (8)
adfc865 
  - data/reports/GO-2023-1912.yaml
  - data/reports/GO-2023-1915.yaml
  - data/reports/GO-2023-1919.yaml
  - data/reports/GO-2023-1922.yaml
  - data/reports/GO-2023-1924.yaml
  - data/reports/GO-2023-1925.yaml
  - data/reports/GO-2023-1927.yaml
  - data/reports/GO-2023-1928.yaml
  - data/reports/GO-2023-1931.yaml
  - data/reports/GO-2023-1932.yaml
  - data/reports/GO-2023-1936.yaml
  - data/reports/GO-2023-1938.yaml
  - data/reports/GO-2023-1939.yaml
  - data/reports/GO-2023-1940.yaml
  - data/reports/GO-2023-1942.yaml
  - data/reports/GO-2023-1945.yaml
  - data/reports/GO-2023-1946.yaml
  - data/reports/GO-2023-1948.yaml
  - data/reports/GO-2023-1950.yaml
  - data/reports/GO-2023-1952.yaml

Updates #1912
Updates #1915
Updates #1919
Updates #1922
Updates #1924
Updates #1925
Updates #1927
Updates #1928
Updates #1931
Updates #1932
Updates #1936
Updates #1938
Updates #1939
Updates #1940
Updates #1942
Updates #1945
Updates #1946
Updates #1948
Updates #1950
Updates #1952

Change-Id: Id25f09c8f7270af68238752db96d6a399b91ef36
Reviewed-on: https://go-review.googlesource.com/c/vulndb/+/606788
Auto-Submit: Tatiana Bradley <tatianabradley@google.com>
LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
Reviewed-by: Damien Neil <dneil@google.com>
@GoVulnBot GoVulnBot mentioned this issue Nov 7, 2024
Closed
@GoVulnBot GoVulnBot mentioned this issue Dec 20, 2024
Closed
@GoVulnBot GoVulnBot mentioned this issue Mar 10, 2025
Closed
# for free to join this conversation on GitHub. Already have an account? # to comment
Assignees

@neild neild

Labels
excluded: EFFECTIVELY_PRIVATE This vulnerability exists in a package can be imported, but isn't meant to be outside that module.
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
3 participants
@neild @gopherbot @GoVulnBot