From eadcf00f84c518985339a9f8a4a837f0b1f32c33 Mon Sep 17 00:00:00 2001
From: "advisory-database[bot]"
 <45398580+advisory-database[bot]@users.noreply.github.com>
Date: Mon, 22 May 2023 18:34:57 +0000
Subject: [PATCH] Publish GHSA-7wg4-8m5p-hrfg

---
 .../2022/11/GHSA-7wg4-8m5p-hrfg/GHSA-7wg4-8m5p-hrfg.json  | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/advisories/github-reviewed/2022/11/GHSA-7wg4-8m5p-hrfg/GHSA-7wg4-8m5p-hrfg.json b/advisories/github-reviewed/2022/11/GHSA-7wg4-8m5p-hrfg/GHSA-7wg4-8m5p-hrfg.json
index 560b049ee29..980db056ff1 100644
--- a/advisories/github-reviewed/2022/11/GHSA-7wg4-8m5p-hrfg/GHSA-7wg4-8m5p-hrfg.json
+++ b/advisories/github-reviewed/2022/11/GHSA-7wg4-8m5p-hrfg/GHSA-7wg4-8m5p-hrfg.json
@@ -1,13 +1,13 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-7wg4-8m5p-hrfg",
-  "modified": "2022-11-10T23:51:44Z",
+  "modified": "2023-05-22T18:33:41Z",
   "published": "2022-11-10T12:01:03Z",
   "aliases": [
     "CVE-2022-3866"
   ],
   "summary": "HashiCorp Nomad vulnerable to non-sensitive metadata exposure",
-  "details": "HashiCorp Nomad and Nomad Enterprise 1.4.0 up to 1.4.1 workload identity token can list non-sensitive metadata for paths under nomad/ that belong to other jobs in the same namespace. Fixed in 1.4.2.",
+  "details": "HashiCorp Nomad and Nomad Enterprise 1.4.0 up to 1.4.1 workload identity token can list non-sensitive metadata for paths under `nomad/` that belong to other jobs in the same namespace. Fixed in 1.4.2.",
   "severity": [
     {
       "type": "CVSS_V3",
@@ -40,6 +40,10 @@
       "type": "ADVISORY",
       "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-3866"
     },
+    {
+      "type": "WEB",
+      "url": "https://github.com/hashicorp/nomad/commit/3b24f26603e2b116ba324101afa8a7e3a7a769a5"
+    },
     {
       "type": "WEB",
       "url": "https://discuss.hashicorp.com/t/hcsec-2022-25-nomad-s-workload-identity-token-can-list-non-sensitive-metadata-for-nomad-paths/46167"