x/vulndb: potential Go vuln in github.com/hashicorp/nomad: GHSA-2jhh-5xm2-j4gf

[julieqiu]

In GitHub Security Advisory GHSA-2jhh-5xm2-j4gf, there is a vulnerability in the following Go packages or modules:

Unit	Fixed	Vulnerable Ranges
github.com/hashicorp/nomad	1.2.1	>= 1.2.0, < 1.2.1

See doc/triage.md for instructions on how to triage this report.

packages:
  - package: github.com/hashicorp/nomad
    versions:
      - introduced: 1.2.0
        fixed: 1.2.1
  - package: github.com/hashicorp/nomad
    versions:
      - introduced: 1.1.0
        fixed: 1.1.8
  - package: github.com/hashicorp/nomad
    versions:
      - fixed: 1.0.14
description: HashiCorp Nomad and Nomad Enterprise up to 1.0.13, 1.1.7, and 1.2.0,
    with the QEMU task driver enabled, allowed authenticated users with job submission
    capabilities to bypass the configured allowed image paths. Fixed in 1.0.14, 1.1.8,
    and 1.2.1.
published: 2021-12-10T20:17:55Z
last_modified: 2021-12-10T20:17:55Z
cves:
  - CVE-2021-43415
ghsas:
  - GHSA-2jhh-5xm2-j4gf
links:
    context:
      - https://github.com/advisories/GHSA-2jhh-5xm2-j4gf

[julieqiu]

Vulnerability in tool.

[gopherbot]

Change https://go.dev/cl/592769 mentions this issue: data/reports: unexclude 50 reports

[gopherbot]

Change https://go.dev/cl/607221 mentions this issue: data/reports: unexclude 20 reports (19)