VulnerabilityModified
CVE-2021-32575
HashiCorp Nomad and Nomad Enterprise up to version 1.0.4 bridge networking mode allows ARP spoofing from other bridged tasks on the same node.
MEDIUM 6.5EPSS 0.51%
Does this matter?
Lower severity and a low EPSS score (0.51%). Track it; it rarely justifies an emergency change on its own.
Description
HashiCorp Nomad and Nomad Enterprise up to version 1.0.4 bridge networking mode allows ARP spoofing from other bridged tasks on the same node. Fixed in 0.12.12, 1.0.5, and 1.1.0 RC1.
- CVSS 3.1
- 6.5 MEDIUMCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
- EPSS
- 0.51% probability · 42th percentile
- CISA KEV
- Not listed
- Affected
- hashicorp/nomad
- Source
- cve@mitre.org
References
- https://discuss.hashicorp.com/t/hcsec-2021-14-nomad-bridge-networking-mode-allows-arp-spoofing-from-other-bridged-tasks-on-same-node/24296Patch, Vendor Advisory
- https://www.hashicorp.com/blog/category/nomadProduct
- https://discuss.hashicorp.com/t/hcsec-2021-14-nomad-bridge-networking-mode-allows-arp-spoofing-from-other-bridged-tasks-on-same-node/24296Patch, Vendor Advisory
- https://www.hashicorp.com/blog/category/nomadProduct
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.