CVE-2024-10975

CVSS V2 None CVSS V3 None
Description
Nomad Community and Nomad Enterprise ("Nomad") volume specification is vulnerable to arbitrary cross-namespace volume creation through unauthorized Container Storage Interface (CSI) volume writes. This vulnerability, identified as CVE-2024-10975, is fixed in Nomad Community Edition 1.9.2 and Nomad Enterprise 1.9.2, 1.8.7, and 1.7.15.
Overview
  • CVE ID
  • CVE-2024-10975
  • Assigner
  • HashiCorp
  • Vulnerability Status
  • PUBLISHED
  • Published Version
  • 2024-11-07T21:04:43.804Z
  • Last Modified Date
  • 2024-11-07T21:22:50.668Z
Weakness Enumerations
CWE URL
CWE-863 http://cwe.mitre.org/data/definitions/863.html
References
Reference URL Reference Tags
https://discuss.hashicorp.com/t/hcsec-2024-27-nomad-vulnerable-to-cross-namespace-volume-creation-abusing-csi-write-permission
Sources
Source Name Source URL
NIST https://nvd.nist.gov/vuln/detail/CVE-2024-10975
MITRE https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-10975
History
Created Old Value New Value Data Type Notes
2024-11-08 13:13:55 Added to TrackCVE