AI and data stack advisories

Severe, 6 weeks1498Projects326

1498 severe, 6 weeks · 326 projects

NomadGHSA-7v3g-4878-5qrf

Nomad Panics On Job Submission With Bad Artifact Stanza Source URL

Nomad

CVE-2022-41606 · Published Oct 12, 2022 · updated May 20, 2025

Medium6.5
Fix: upgrade to 1.2.13 or later (2 fixed versions below)
GitHub advisory

HashiCorp Nomad and Nomad Enterprise 1.0.2 up to 1.2.12, and 1.3.5 jobs submitted with an artifact stanza using invalid S3 or GCS URLs can be used to crash client agents. Fixed in 1.2.13, 1.3.6, and 1.4.0.

Affected versions

PackageAffectedFixed in
github.com/hashicorp/nomad
Go
< 1.2.131.2.13
>= 1.3.0, < 1.3.61.3.6
Details and references
CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Severity from
GitHub (reviewed advisory)
Weakness
CWE-20
Also known as
CVE-2022-41606, GO-2022-1062

More Nomad advisories

All Nomad
High 8.8Mar 14, 2023Nomad Job Submitter Privilege Escalation Using Workload IdentityCVE-2023-1299fixed in 1.5.1Medium 6.5Feb 17, 2023Uncontrolled Resource Consumption in Hashicorp NomadCVE-2023-0821fixed in 1.2.16 +2Low 2.7Nov 10, 2022HashiCorp Nomad vulnerable to Insufficient Session ExpirationCVE-2022-3867fixed in 1.4.2Medium 5.0Nov 10, 2022HashiCorp Nomad vulnerable to non-sensitive metadata exposureCVE-2022-3866fixed in 1.4.2Critical 9.8Jun 3, 2022Privilege escalation in Hashicorp NomadCVE-2022-30324fixed in 1.1.14 +2Critical 9.8May 24, 2022Hashicorp Nomad Access Control IssuesCVE-2019-12618fixed in 0.9.2