-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from the archive unpacking logic in streamAllocDir where symlinks were created without validating their targets. The patch adds escapingfs.PathEscapesAllocDir checks precisely in this function's symlink handling block, confirming this was the missing security validation. The CWE-59 (Link Following) classification directly maps to this symlink handling code path.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/hashicorp/nomad | go | = 1.5.13 | 1.5.14 |
| github.com/hashicorp/nomad | go | >= 1.6.0, <= 1.6.6 | 1.6.7 |
| github.com/hashicorp/nomad | go | = 1.7.3 | 1.7.4 |