GHSA-7v3g-4878-5qrf
Nomad Panics On Job Submission With Bad Artifact Stanza Source URL
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Go | github.com/hashicorp/nomad | < 1.2.13 | 1.2.13 |
| Go | github.com/hashicorp/nomad | >= 1.3.0, < 1.3.6 | 1.3.6 |
Details
As written in the advisory (Markdown source, shown as plain text).
HashiCorp Nomad and Nomad Enterprise 1.0.2 up to 1.2.12, and 1.3.5 jobs submitted with an artifact stanza using invalid S3 or GCS URLs can be used to crash client agents. Fixed in 1.2.13, 1.3.6, and 1.4.0.
References
External links from the advisory. They lead to third-party sites.