nvd-json-data-feeds/CVE-2022/CVE-2022-416xx/CVE-2022-41606.json

{
  "id": "CVE-2022-41606",
  "sourceIdentifier": "cve@mitre.org",
  "published": "2022-10-12T00:15:10.537",
  "lastModified": "2022-10-13T17:16:16.880",
  "vulnStatus": "Analyzed",
  "descriptions": [
    {
      "lang": "en",
      "value": "HashiCorp Nomad and Nomad Enterprise 1.0.2 up to 1.2.12, and 1.3.5 jobs submitted with an artifact stanza using invalid S3 or GCS URLs can be used to crash client agents. Fixed in 1.2.13, 1.3.6, and 1.4.0."
    },
    {
      "lang": "es",
      "value": "Los trabajos de HashiCorp Nomad y Nomad Enterprise versiones 1.0.2 hasta 1.2.12, y 1.3.5, enviados con una estrofa de artefacto usando URLs S3 o GCS no v\u00e1lidas pueden ser usados para bloquear los agentes cliente. Corregido en versiones 1.2.13, 1.3.6 y 1.4.0"
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "nvd@nist.gov",
        "type": "Primary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "availabilityImpact": "HIGH",
          "baseScore": 6.5,
          "baseSeverity": "MEDIUM"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 3.6
      }
    ]
  },
  "weaknesses": [
    {
      "source": "nvd@nist.gov",
      "type": "Primary",
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-noinfo"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:hashicorp:nomad:*:*:*:*:-:*:*:*",
              "versionStartIncluding": "1.0.2",
              "versionEndExcluding": "1.2.13",
              "matchCriteriaId": "8043FBD6-1363-4829-8635-FFE486F76986"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:hashicorp:nomad:*:*:*:*:enterprise:*:*:*",
              "versionStartIncluding": "1.0.2",
              "versionEndExcluding": "1.2.13",
              "matchCriteriaId": "41143EB3-7927-4C48-887E-2D6B6AFF1A15"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:hashicorp:nomad:*:*:*:*:-:*:*:*",
              "versionStartIncluding": "1.3.0",
              "versionEndExcluding": "1.3.6",
              "matchCriteriaId": "5A97DD24-5BA6-4D1A-8712-0C6C852AD00B"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:hashicorp:nomad:*:*:*:*:enterprise:*:*:*",
              "versionStartIncluding": "1.3.0",
              "versionEndExcluding": "1.3.6",
              "matchCriteriaId": "582537C8-CF33-40C5-BA50-066DF02A00A9"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://discuss.hashicorp.com",
      "source": "cve@mitre.org",
      "tags": [
        "Vendor Advisory"
      ]
    },
    {
      "url": "https://discuss.hashicorp.com/t/hcsec-2022-22-nomad-panics-on-job-submission-with-bad-artifact-stanza-source-url/45420",
      "source": "cve@mitre.org",
      "tags": [
        "Vendor Advisory"
      ]
    }
  ]
}