Riskcovery

CVE-2022-3867

Nomad Event Stream Subscriber Using a Token with TTL Receives Updates Until Garbage Collected

State
Published
Severity
2.7 Low
Published
Nov 10, 2022
Updated
May 1, 2025
Reserved
Nov 4, 2022

Read the record on cve.org

Description

HashiCorp Nomad and Nomad Enterprise 1.4.0 up to 1.4.1 event stream subscribers using a token with TTL receive updates until token garbage is collected. Fixed in 1.4.2.

Scores

CVSSScoreVectorSource
3.12.7 LowCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:NHashiCorp

Weaknesses

  • CWE-613 Insufficient Session Expiration

Affected Products

ProductVersions
NomadHashiCorp
  • 1.4.0Affected
  • 1.4.1Affected
Nomad EnterpriseHashiCorp
  • 1.4.0Affected
  • 1.4.1Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.