{"schema_version":"1.3.1","id":"GO-2024-2669","modified":"2024-05-20T16:03:47Z","published":"2024-04-04T18:42:45Z","aliases":["CVE-2023-3299","GHSA-9jfx-84v9-2rr2"],"summary":"API token secret ID leak to Sentinel in github.com/hashicorp/nomad","details":"A vulnerability exists in Nomad where the API caller's ACL token secret ID is exposed to Sentinel policies.","affected":[{"package":{"name":"github.com/hashicorp/nomad","ecosystem":"Go"},"ranges":[{"type":"SEMVER","events":[{"introduced":"1.2.11"},{"fixed":"1.4.11"},{"introduced":"1.5.0"},{"fixed":"1.5.7"}]}],"ecosystem_specific":{}}],"references":[{"type":"REPORT","url":"https://github.com/hashicorp/nomad/issues/17907"},{"type":"WEB","url":"https://discuss.hashicorp.com/t/hcsec-2023-21-nomad-caller-acl-tokens-secret-id-is-exposed-to-sentinel/56271"}],"credits":[{"name":"anonymous4ACL24"}],"database_specific":{"url":"https://pkg.go.dev/vuln/GO-2024-2669","review_status":"REVIEWED"}}