GHSA-7v3g-4878-5qrf

ghsaUSosv

Nomad Panics On Job Submission With Bad Artifact Stanza Source URL

view advisory published 2022-10-12Licence: CC-BY-4.0

HashiCorp Nomad and Nomad Enterprise 1.0.2 up to 1.2.12, and 1.3.5 jobs submitted with an artifact stanza using invalid S3 or GCS URLs can be used to crash client agents. Fixed in 1.2.13, 1.3.6, and 1.4.0.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2022-41606US	medium6.5	0.85% (58th)	—	2022-10-12
HashiCorp Nomad and Nomad Enterprise 1.0.2 up to 1.2.12, and 1.3.5 jobs submitted with an artifact stanza using invalid S3 or GCS URLs can be used to crash client agents. Fixed in…

references

External citations — patches, advisories, analysis.

https://discuss.hashicorp.comWEB
https://discuss.hashicorp.com/t/hcsec-2022-22-nomad-panics-on-job-submission-with-bad-artifact-stanza-source-url/45420WEB
https://github.com/hashicorp/nomadPACKAGE
https://nvd.nist.gov/vuln/detail/CVE-2022-41606ADVISORY
https://pkg.go.dev/vuln/GO-2022-1062WEB

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan