HashiCorp Nomad vulnerable to Insufficient Session Expiration

中危 4.3CVE-2022-3867 · GHSA-9fmc-5fq4-5jwh · GO-2022-1106 · Published 10/11/2022 · updated 17/06/2026

要点

CVE-2022-3867 是影响 github.com/hashicorp/nomad, nomad (hashicorp) 的中危 (CVSS 4.3)漏洞。
未来 30 天内被利用的概率（EPSS）：0.51%，高于 43.5% 的漏洞。
修复：升级到 1.4.2 或更高版本。

Package	Affected versions	Patched versions
github.com/hashicorp/nomad Go	`≥ 1.4.0, < 1.4.2`	`1.4.2`
nomad hashicorp	`= 1.4.0= 1.4.1`	No fix yet

Description

HashiCorp Nomad and Nomad Enterprise 1.4.0 up to 1.4.1 event stream subscribers using a token with TTL receive updates until token garbage is collected. Fixed in 1.4.2.

NVD description

HashiCorp Nomad and Nomad Enterprise 1.4.0 up to 1.4.1 event stream subscribers using a token with TTL receive updates until token garbage is collected. Fixed in 1.4.2.

References

nvd.nist.gov/vuln/detail/CVE-2022-3867 · ADVISORY
hashicorp/nomad commit dd6a463 · WEB
discuss.hashicorp.com/t/hcsec-2022-26-nomad-s-event-stream-subscriber-using-acl-token-with-ttl-receive-updates-until-garbage-collected/46168 · WEB
hashicorp/nomad · PACKAGE
GitHub Advisory GHSA-9fmc-5fq4-5jwh · ADVISORY

github.com/hashicorp/nomad 的其他漏洞

查看全部 →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

github.com/hashicorp/nomad

≥ 1.4.0, < 1.4.2

1.4.2

nomad

hashicorp

= 1.4.0= 1.4.1

No fix yet

Description

HashiCorp Nomad and Nomad Enterprise 1.4.0 up to 1.4.1 event stream subscribers using a token with TTL receive updates until token garbage is collected. Fixed in 1.4.2.

NVD description

HashiCorp Nomad and Nomad Enterprise 1.4.0 up to 1.4.1 event stream subscribers using a token with TTL receive updates until token garbage is collected. Fixed in 1.4.2.

github.com/hashicorp/nomad 的其他漏洞

查看全部 →