CVE-2024-6717

Published: Jul 23, 2024Modified: Jun 17, 2026

8.6

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N

Exploitability: 3.9 / Impact: 4.0

Source: NVD

Description

HashiCorp Nomad and Nomad Enterprise 1.6.12 up to 1.7.9, and 1.8.1 archive unpacking during migration is vulnerable to path escaping of the allocation directory. This vulnerability, CVE-2024-6717, is fixed in Nomad 1.6.13, 1.7.10, and 1.8.2.

Affected (6)

Products: Hashicorp: Nomad

Hashicorp

1 product

Nomad

Configuration A

6 vulnerable

Vulnerable Software	Affected Versions
Hashicorp Nomad	From 1.7.0 to 1.7.10
Hashicorp Nomad	From 1.7.0 to 1.7.10
Hashicorp Nomad	Version 1.6.12
Hashicorp Nomad	Version 1.6.12
Hashicorp Nomad	Version 1.8.1
Hashicorp Nomad	Version 1.8.1

Related CWEs

CWE-610

Externally Controlled Reference to a Resource in Another Sphere

The product uses an externally controlled name or reference that resolves to a resource that is outside of the intended control sphere.

References (2)

https://discuss.hashicorp.com/t/hcsec-2024-15-nomad-vulnerable-to-allocation-directory-path-escape-through-archive-unpacking/68781

Source: security@hashicorp.com

Vendor Advisory

https://discuss.hashicorp.com/t/hcsec-2024-15-nomad-vulnerable-to-allocation-directory-path-escape-through-archive-unpacking/68781

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

Timeline

No history available yet.