← Back

CVE-2024-7625

nvd nist
Published: Aug 15, 2024Modified: Jun 17, 2026

JSON object

Loading...
5.8
Vector
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:N/I:H/A:N
Exploitability: 1.3 / Impact: 4.0
Source: security@hashicorp.com (Secondary)

Description

In HashiCorp Nomad and Nomad Enterprise from 0.6.1 up to 1.6.13, 1.7.10, and 1.8.2, the archive unpacking process is vulnerable to writes outside the allocation directory during migration of allocation directories when multiple archive headers target the same file. This vulnerability, CVE-2024-7625, is fixed in Nomad 1.6.14, 1.7.11, and 1.8.3. Access or compromise of the Nomad client agent at the source allocation first is a prerequisite for leveraging this vulnerability.

Affected (6)

Products: Hashicorp: Nomad
Hashicorp
1 product
Nomad
Configuration A
6 vulnerable
Vulnerable SoftwareAffected Versions
Hashicorp
Nomad
From 0.6.1 to 1.6.14
Nomad
From 1.7.0 to 1.7.11
Nomad
From 1.8.0 to 1.8.3
Nomad
From 0.6.1 to 1.6.14
Nomad
From 1.7.0 to 1.7.11
Nomad
From 1.8.0 to 1.8.3

Related CWEs

CWE-610
Externally Controlled Reference to a Resource in Another Sphere
The product uses an externally controlled name or reference that resolves to a resource that is outside of the intended control sphere.

References (1)

Source: security@hashicorp.com
Vendor Advisory

Timeline

No history available yet.