CVE-2020-7956: Improper Certificate Validation

May 18, 2021

HashiCorp Nomad and Nomad Enterprise up to 0.10.2 incorrectly validated role/region associated with TLS certificates used for mTLS RPC, and were susceptible to privilege escalation. Fixed in 0.10.3.

References

github.com/advisories/GHSA-cj2h-ww36-v932
github.com/hashicorp/nomad/issues/7003
github.com/hashicorp/nomad/pull/7023
nvd.nist.gov/vuln/detail/CVE-2020-7956

Code Behaviors & Features

Detect and mitigate CVE-2020-7956 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →