Ecosyste.ms: Advisories

An open API service providing security vulnerability metadata for many open source software ecosystems.

Advisories: GSA_kwCzR0hTQS04ZmNqLWdmNzctNDdtZ84AAxJB

Denial of service (DoS) when processing Git credentials

Impact

A denial of services (DoS) vulnerability was discovered in Wrangler Git package affecting versions up to and including v1.0.0.

Specially crafted Git credentials can result in a denial of service (DoS) attack on an application that uses Wrangler due to the exhaustion of the available memory and CPU resources. This is caused by a lack of input validation of Git credentials before they are used, which may lead to a denial of service in some cases. This issue can be triggered when accessing both private and public Git repositories.

Workarounds

A workaround is to sanitize input passed to the Git package to remove potential unsafe and ambiguous characters. Otherwise, the best course of action is to update to a patched Wrangler version.

Patches

Patched versions include v1.0.1 and later and the backported tags - v0.7.4-security1, v0.8.5-security1 and v0.8.11.

For more information

If you have any questions or comments about this advisory:

Permalink: https://github.com/advisories/GHSA-8fcj-gf77-47mg

Source: GitHub Advisory Database
Origin: Unspecified
Severity: Moderate
Classification: General
Published: 13 days ago
Updated: 13 days ago

CVSS Score: 5.9
CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H

Identifiers: GHSA-8fcj-gf77-47mg, CVE-2022-43756
References:

Affected Packages

go:github.com/rancher/wrangler
Versions: >= 0.8.6, < 0.8.11, = 1.0.0, >= 0.8.0, <= 0.8.4, <= 0.7.3
Fixed in: 0.8.11, 1.0.1, 0.8.5-security1, 0.7.4-security1