CVE-2020-7956 (NVD)

2020-01-31

HashiCorp Nomad and Nomad Enterprise up to 0.10.2 incorrectly validated role/region associated with TLS certificates used for mTLS RPC, and were susceptible to privilege escalation. Fixed in 0.10.3.

Products Nomad
Type Improper Certificate Validation (CWE-295)
First patch - None (likely due to unavailable code)
Links https://github.com/hashicorp/nomad/issues/7003
https://www.hashicorp.com/blog/category/nomad/