From d374ebcd809555e298b8e0a32bd80f6d2dba7d47 Mon Sep 17 00:00:00 2001
From: "advisory-database[bot]"
 <45398580+advisory-database[bot]@users.noreply.github.com>
Date: Thu, 15 Aug 2024 21:26:32 +0000
Subject: [PATCH] Publish Advisories

GHSA-25qx-vfw2-fw8r
GHSA-25qx-vfw2-fw8r
---
 .../GHSA-25qx-vfw2-fw8r.json                  | 103 ++++++++++++++++++
 .../GHSA-25qx-vfw2-fw8r.json                  |  38 -------
 2 files changed, 103 insertions(+), 38 deletions(-)
 create mode 100644 advisories/github-reviewed/2024/08/GHSA-25qx-vfw2-fw8r/GHSA-25qx-vfw2-fw8r.json
 delete mode 100644 advisories/unreviewed/2024/08/GHSA-25qx-vfw2-fw8r/GHSA-25qx-vfw2-fw8r.json

diff --git a/advisories/github-reviewed/2024/08/GHSA-25qx-vfw2-fw8r/GHSA-25qx-vfw2-fw8r.json b/advisories/github-reviewed/2024/08/GHSA-25qx-vfw2-fw8r/GHSA-25qx-vfw2-fw8r.json
new file mode 100644
index 00000000000..f24951aebd5
--- /dev/null
+++ b/advisories/github-reviewed/2024/08/GHSA-25qx-vfw2-fw8r/GHSA-25qx-vfw2-fw8r.json
@@ -0,0 +1,103 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-25qx-vfw2-fw8r",
+  "modified": "2024-08-15T21:24:57Z",
+  "published": "2024-08-15T00:30:59Z",
+  "aliases": [
+    "CVE-2024-7625"
+  ],
+  "summary": "Nomad Vulnerable to Allocation Directory Escape On Non-Existing File Paths Through Archive Unpacking",
+  "details": "In HashiCorp Nomad and Nomad Enterprise from 0.6.1 up to 1.16.13, 1.7.10, and 1.8.2, the archive unpacking process is vulnerable to writes outside the allocation directory during migration of allocation directories when multiple archive headers target the same file. This vulnerability, CVE-2024-7625, is fixed in Nomad 1.6.14, 1.7.11, and 1.8.3. Access or compromise of the Nomad client agent at the source allocation first is a prerequisite for leveraging this vulnerability.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:N/I:H/A:N"
+    },
+    {
+      "type": "CVSS_V4",
+      "score": "CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N"
+    }
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "Go",
+        "name": "github.com/hashicorp/nomad"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0.6.1"
+            },
+            {
+              "fixed": "1.6.14"
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "package": {
+        "ecosystem": "Go",
+        "name": "github.com/hashicorp/nomad"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "1.7.0"
+            },
+            {
+              "fixed": "1.7.11"
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "package": {
+        "ecosystem": "Go",
+        "name": "github.com/hashicorp/nomad"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "1.8.0"
+            },
+            {
+              "fixed": "1.8.3"
+            }
+          ]
+        }
+      ]
+    }
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-7625"
+    },
+    {
+      "type": "WEB",
+      "url": "https://discuss.hashicorp.com/t/hcsec-2024-17-nomad-vulnerable-to-allocation-directory-escape-on-non-existing-file-paths-through-archive-unpacking/69293"
+    },
+    {
+      "type": "PACKAGE",
+      "url": "github.com/hashicorp/nomad"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-610"
+    ],
+    "severity": "MODERATE",
+    "github_reviewed": true,
+    "github_reviewed_at": "2024-08-15T21:24:57Z",
+    "nvd_published_at": "2024-08-15T00:15:13Z"
+  }
+}
\ No newline at end of file
diff --git a/advisories/unreviewed/2024/08/GHSA-25qx-vfw2-fw8r/GHSA-25qx-vfw2-fw8r.json b/advisories/unreviewed/2024/08/GHSA-25qx-vfw2-fw8r/GHSA-25qx-vfw2-fw8r.json
deleted file mode 100644
index 2f896951d62..00000000000
--- a/advisories/unreviewed/2024/08/GHSA-25qx-vfw2-fw8r/GHSA-25qx-vfw2-fw8r.json
+++ /dev/null
@@ -1,38 +0,0 @@
-{
-  "schema_version": "1.4.0",
-  "id": "GHSA-25qx-vfw2-fw8r",
-  "modified": "2024-08-15T00:30:59Z",
-  "published": "2024-08-15T00:30:59Z",
-  "aliases": [
-    "CVE-2024-7625"
-  ],
-  "details": "In HashiCorp Nomad and Nomad Enterprise from 0.6.1 up to 1.16.13, 1.7.10, and 1.8.2, the archive unpacking process is vulnerable to writes outside the allocation directory during migration of allocation directories when multiple archive headers target the same file. This vulnerability, CVE-2024-7625, is fixed in Nomad 1.6.14, 1.7.11, and 1.8.3. Access or compromise of the Nomad client agent at the source allocation first is a prerequisite for leveraging this vulnerability.",
-  "severity": [
-    {
-      "type": "CVSS_V3",
-      "score": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:N/I:H/A:N"
-    }
-  ],
-  "affected": [
-
-  ],
-  "references": [
-    {
-      "type": "ADVISORY",
-      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-7625"
-    },
-    {
-      "type": "WEB",
-      "url": "https://discuss.hashicorp.com/t/hcsec-2024-17-nomad-vulnerable-to-allocation-directory-escape-on-non-existing-file-paths-through-archive-unpacking/69293"
-    }
-  ],
-  "database_specific": {
-    "cwe_ids": [
-      "CWE-610"
-    ],
-    "severity": "MODERATE",
-    "github_reviewed": false,
-    "github_reviewed_at": null,
-    "nvd_published_at": "2024-08-15T00:15:13Z"
-  }
-}
\ No newline at end of file