GitHub Advisoryadvisory · Go

GHSA-7v3g-4878-5qrf Nomad Panics On Job Submission With Bad Artifact Stanza Source URL

MEDIUM Published 2022-10-12 Modified 2025-05-20 Official page ↗
Aliases
CVE-2022-41606
Ecosystem
Go
Packages
github.com/hashicorp/nomad
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-20
Reviewed
2022-10-12

Affected packages

• Go github.com/hashicorp/nomad: < 1.2.13 → fixed in 1.2.13 • Go github.com/hashicorp/nomad: >= 1.3.0, < 1.3.6 → fixed in 1.3.6

Description

HashiCorp Nomad and Nomad Enterprise 1.0.2 up to 1.2.12, and 1.3.5 jobs submitted with an artifact stanza using invalid S3 or GCS URLs can be used to crash client agents. Fixed in 1.2.13, 1.3.6, and 1.4.0.

Related

Alias · CVE (1)

  • CVE-2022-41606 HashiCorp Nomad and Nomad Enterprise 1.0.2 up to 1.2.12, and 1.3.5 jobs submitted with an artifact stanza using invalid S3 or GCS URLs can… vulnerability

Weakness · CWE (1)

  • CWE-20 Improper Input Validation weakness

References