CVE-2023-0821: Uncontrolled Resource Consumption in Hashicorp Nomad

February 17, 2023

HashiCorp Nomad and Nomad Enterprise 1.2.15 up to 1.3.8, and 1.4.3 jobs using a maliciously compressed artifact stanza source can cause excessive disk usage. Fixed in 1.2.16, 1.3.9, and 1.4.4.

References

discuss.hashicorp.com/t/hcsec-2023-05-nomad-client-vulnerable-to-decompression-bombs-in-artifact-block/50292
github.com/advisories/GHSA-w479-w22g-cffh
nvd.nist.gov/vuln/detail/CVE-2023-0821

Code Behaviors & Features

Detect and mitigate CVE-2023-0821 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →