{
  "GSD": {
    "alias": "CVE-2022-41606",
    "id": "GSD-2022-41606"
  },
  "gsd": {
    "metadata": {
      "exploitCode": "unknown",
      "remediation": "unknown",
      "reportConfidence": "confirmed",
      "type": "vulnerability"
    },
    "osvSchema": {
      "aliases": [
        "CVE-2022-41606"
      ],
      "details": "HashiCorp Nomad and Nomad Enterprise 1.0.2 up to 1.2.12, and 1.3.5 jobs submitted with an artifact stanza using invalid S3 or GCS URLs can be used to crash client agents. Fixed in 1.2.13, 1.3.6, and 1.4.0.",
      "id": "GSD-2022-41606",
      "modified": "2023-12-13T01:19:32.663331Z",
      "schema_version": "1.4.0"
    }
  },
  "namespaces": {
    "cve.org": {
      "CVE_data_meta": {
        "ASSIGNER": "cve@mitre.org",
        "ID": "CVE-2022-41606",
        "STATE": "PUBLIC"
      },
      "affects": {
        "vendor": {
          "vendor_data": [
            {
              "product": {
                "product_data": [
                  {
                    "product_name": "n/a",
                    "version": {
                      "version_data": [
                        {
                          "version_value": "n/a"
                        }
                      ]
                    }
                  }
                ]
              },
              "vendor_name": "n/a"
            }
          ]
        }
      },
      "data_format": "MITRE",
      "data_type": "CVE",
      "data_version": "4.0",
      "description": {
        "description_data": [
          {
            "lang": "eng",
            "value": "HashiCorp Nomad and Nomad Enterprise 1.0.2 up to 1.2.12, and 1.3.5 jobs submitted with an artifact stanza using invalid S3 or GCS URLs can be used to crash client agents. Fixed in 1.2.13, 1.3.6, and 1.4.0."
          }
        ]
      },
      "problemtype": {
        "problemtype_data": [
          {
            "description": [
              {
                "lang": "eng",
                "value": "n/a"
              }
            ]
          }
        ]
      },
      "references": {
        "reference_data": [
          {
            "name": "https://discuss.hashicorp.com",
            "refsource": "MISC",
            "url": "https://discuss.hashicorp.com"
          },
          {
            "name": "https://discuss.hashicorp.com/t/hcsec-2022-22-nomad-panics-on-job-submission-with-bad-artifact-stanza-source-url/45420",
            "refsource": "MISC",
            "url": "https://discuss.hashicorp.com/t/hcsec-2022-22-nomad-panics-on-job-submission-with-bad-artifact-stanza-source-url/45420"
          }
        ]
      }
    },
    "gitlab.com": {
      "advisories": [
        {
          "affected_range": "\u003c1.2.13||\u003e=1.3.0 \u003c1.3.6",
          "affected_versions": "All versions before 1.2.13, all versions starting from 1.3.0 before 1.3.6",
          "cvss_v3": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
          "cwe_ids": [
            "CWE-1035",
            "CWE-937"
          ],
          "date": "2022-10-13",
          "description": "HashiCorp Nomad and Nomad Enterprise 1.0.2 up to 1.2.12, and 1.3.5 jobs submitted with an artifact stanza using invalid S3 or GCS URLs can be used to crash client agents. Fixed in 1.2.13, 1.3.6, and 1.4.0.",
          "fixed_versions": [
            "1.2.13",
            "1.3.6"
          ],
          "identifier": "CVE-2022-41606",
          "identifiers": [
            "GHSA-7v3g-4878-5qrf",
            "CVE-2022-41606"
          ],
          "not_impacted": "All versions starting from 1.2.13 before 1.3.0, all versions starting from 1.3.6",
          "package_slug": "go/github.com/hashicorp/nomad",
          "pubdate": "2022-10-12",
          "solution": "Upgrade to versions 1.2.13, 1.3.6 or above.",
          "title": "Nomad Panics On Job Submission With Bad Artifact Stanza Source URL",
          "urls": [
            "https://nvd.nist.gov/vuln/detail/CVE-2022-41606",
            "https://discuss.hashicorp.com/t/hcsec-2022-22-nomad-panics-on-job-submission-with-bad-artifact-stanza-source-url/45420",
            "https://discuss.hashicorp.com",
            "https://github.com/advisories/GHSA-7v3g-4878-5qrf"
          ],
          "uuid": "c50a97c6-4705-4984-aced-6cca1d916107"
        }
      ]
    },
    "nvd.nist.gov": {
      "configurations": {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:a:hashicorp:nomad:*:*:*:*:-:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "1.2.13",
                "versionStartIncluding": "1.0.2",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:hashicorp:nomad:*:*:*:*:enterprise:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "1.2.13",
                "versionStartIncluding": "1.0.2",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:hashicorp:nomad:*:*:*:*:enterprise:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "1.3.6",
                "versionStartIncluding": "1.3.0",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:hashicorp:nomad:*:*:*:*:-:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "1.3.6",
                "versionStartIncluding": "1.3.0",
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      },
      "cve": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2022-41606"
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "en",
              "value": "HashiCorp Nomad and Nomad Enterprise 1.0.2 up to 1.2.12, and 1.3.5 jobs submitted with an artifact stanza using invalid S3 or GCS URLs can be used to crash client agents. Fixed in 1.2.13, 1.3.6, and 1.4.0."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "en",
                  "value": "NVD-CWE-noinfo"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://discuss.hashicorp.com/t/hcsec-2022-22-nomad-panics-on-job-submission-with-bad-artifact-stanza-source-url/45420",
              "refsource": "MISC",
              "tags": [
                "Vendor Advisory"
              ],
              "url": "https://discuss.hashicorp.com/t/hcsec-2022-22-nomad-panics-on-job-submission-with-bad-artifact-stanza-source-url/45420"
            },
            {
              "name": "https://discuss.hashicorp.com",
              "refsource": "MISC",
              "tags": [
                "Vendor Advisory"
              ],
              "url": "https://discuss.hashicorp.com"
            }
          ]
        }
      },
      "impact": {
        "baseMetricV3": {
          "cvssV3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "exploitabilityScore": 2.8,
          "impactScore": 3.6
        }
      },
      "lastModifiedDate": "2022-10-13T17:16Z",
      "publishedDate": "2022-10-12T00:15Z"
    }
  }
}