# HCSEC-2022-22 - Nomad Panics On Job Submission With Bad Artifact Stanza Source URL

**URL:** <https://discuss.hashicorp.com/t/hcsec-2022-22-nomad-panics-on-job-submission-with-bad-artifact-stanza-source-url/45420>\
**Category:** Security\
**Tags:** security-nomad\
**Created:** [October 10, 2022, 10:51pm UTC](https://discuss.hashicorp.com/t/hcsec-2022-22-nomad-panics-on-job-submission-with-bad-artifact-stanza-source-url/45420 "2022-10-10T22:51:12Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![jfinnigan](https://sea2.discourse-cdn.com/hashicorp/user_avatar/discuss.hashicorp.com/jfinnigan/32/3834_2.png) [@jfinnigan](https://discuss.hashicorp.com/u/jfinnigan)\
**Post date:** [October 10, 2022, 10:51pm UTC](https://discuss.hashicorp.com/t/hcsec-2022-22-nomad-panics-on-job-submission-with-bad-artifact-stanza-source-url/45420/1 "2022-10-10T22:51:12Z")

</div>

**Bulletin ID:** HCSEC-2022-22  
**Affected Products / Versions:** Nomad and Nomad Enterprise 1.0.2 up to 1.2.12, and 1.3.5; fixed in 1.2.13, 1.3.6, and 1.4.0.  
**Publication Date:** October 10, 2022

**Summary**  
A vulnerability was identified in Nomad and Nomad Enterprise (“Nomad”) such that a job submitted with an invalid S3 or GCS URL in an `artifact` stanza can cause a panic, crashing a Nomad client agent. This vulnerability, CVE-2022-41606, was fixed in Nomad 1.2.13, 1.3.6, and 1.4.0.

**Background**  
Nomad utilizes HashiCorp’s [go-getter](https://github.com/hashicorp/go-getter) library for its [`artifact`](https://developer.hashicorp.com/nomad/docs/job-specification/artifact) stanza that can be included in jobs submitted to the cluster. These custom artifacts (files) can be retrieved using various protocols.

**Details**  
An external party reported it was possible to crash Nomad client agents using an invalid AWS S3 or GCP GCS URL in an artifact stanza. This behavior may be used by a malicious operator or third party with authenticated access to the [`submit-job`](https://learn.hashicorp.com/tutorials/nomad/access-control-policies#submit-job) capability to perform a denial of service attack.

Nomad’s usage of go-getter has been modified to allow Nomad to recover from panics during artifact retrieval, both preventing an agent crash in the specific cases described and protecting against similar issues that may be discovered in future.

**Remediation**  
Customers should evaluate the risk associated with this issue and consider upgrading to Nomad 1.2.13, 1.3.6, or 1.4.0, or newer.

See Nomad’s [Upgrading](https://www.nomadproject.io/docs/upgrade) for general guidance on this process.

**Acknowledgement**  
This issue was identified by a Nomad open source user.

_We deeply appreciate any effort to coordinate disclosure of security vulnerabilities. For information about security at HashiCorp and the reporting of security vulnerabilities, please see [https://hashicorp.com/security.](https://hashicorp.com/security.)_