Nomad Panics On Job Submission With Bad Artifact Stanza Source URL
Date: 2022-10
Affected: go/github.com/hashicorp/nomad, go/github.com/hashicorp/nomad
Attack vector: other
Category: vulnerability-disclosure
Severity: Critical
CVE: CVE-2022-24686
CVE-2022-30324
CVE-2022-40716
CVE-2022-41606
CWE: CWE-20
CWE-252
CWE-362
CVSS: 6.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)

HashiCorp Nomad and Nomad Enterprise 1.0.2 up to 1.2.12, and 1.3.5 jobs submitted with an artifact stanza using invalid S3 or GCS URLs can be used to crash client agents. Fixed in 1.2.13, 1.3.6, and 1.4.0.


Mitigations:

Architectural layers (MAESTRO):