Environment Variable Disclosure in HashiCorp Nomad by HashiCorp
CVE-2019-14802

5.3MEDIUM

Key Information:

Vendor

Hashicorp
Status
Nomad
Vendor
CVE Published:
26 December 2022

What is CVE-2019-14802?

An environment variable disclosure vulnerability was found in HashiCorp Nomad versions 0.5.0 through 0.9.4. This flaw allows unintended exposure of sensitive environment variables during the template rendering process in the components nomad/client/allocrunner/taskrunner/template. This can potentially lead to information leakage, compromising the confidentiality of sensitive data. The issue has been addressed in version 0.9.5, and users are encouraged to update their installations to mitigate the risk.

References

https://www.hashicorp.com/blog/category/nomad
https://advisories.gitlab.com/advisory/advgo_github_com_h...

CVSS V3.1

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.
CVE-2019-14802 : Environment Variable Disclosure in HashiCorp Nomad by HashiCorp