Ecosyste.ms: Advisories
An open API service providing security vulnerability metadata for many open source software ecosystems.
Security Advisories: GSA_kwCzR0hTQS04ZmNqLWdmNzctNDdtZ84AAxJB
Denial of service (DoS) when processing Git credentials
Impact
A denial of services (DoS) vulnerability was discovered in Wrangler Git package affecting versions up to and including v1.0.0.
Specially crafted Git credentials can result in a denial of service (DoS) attack on an application that uses Wrangler due to the exhaustion of the available memory and CPU resources. This is caused by a lack of input validation of Git credentials before they are used, which may lead to a denial of service in some cases. This issue can be triggered when accessing both private and public Git repositories.
Workarounds
A workaround is to sanitize input passed to the Git package to remove potential unsafe and ambiguous characters. Otherwise, the best course of action is to update to a patched Wrangler version.
Patches
Patched versions include v1.0.1 and later and the backported tags - v0.7.4-security1, v0.8.5-security1 and v0.8.11.
For more information
If you have any questions or comments about this advisory:
- Reach out to SUSE Rancher Security team for security related inquiries.
- Open an issue in Rancher or Wrangler repository.
- Verify our support matrix and product support lifecycle.
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS04ZmNqLWdmNzctNDdtZ84AAxJB
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Moderate
Classification: General
Published: about 1 year ago
Updated: about 1 year ago
CVSS Score: 5.9
CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H
Identifiers: GHSA-8fcj-gf77-47mg, CVE-2022-43756
References:
- https://github.com/rancher/wrangler/security/advisories/GHSA-8fcj-gf77-47mg
- https://nvd.nist.gov/vuln/detail/CVE-2022-43756
- https://bugzilla.suse.com/show_bug.cgi?id=1205296
- https://github.com/rancher/wrangler/commit/341018c8fef3e12867c7cb2649bd2cecac75f287
- https://github.com/advisories/GHSA-8fcj-gf77-47mg
- https://github.com/rancher/rancher/security/policy
- https://pkg.go.dev/vuln/GO-2023-1515
Blast Radius: 16.0
Affected Packages
go:github.com/rancher/wrangler
Dependent packages: 566Dependent repositories: 510
Downloads:
Affected Version Ranges: >= 0.8.6, < 0.8.11, = 1.0.0, >= 0.8.0, <= 0.8.4, <= 0.7.3
Fixed in: 0.8.11, 1.0.1, 0.8.5-security1, 0.7.4-security1
All affected versions: 0.1.0, 0.1.1, 0.1.2, 0.1.3, 0.1.4, 0.1.5, 0.1.6, 0.2.0, 0.3.0, 0.3.1, 0.4.0, 0.4.1, 0.5.0, 0.5.1, 0.5.2, 0.5.3, 0.6.0, 0.6.1, 0.6.2, 0.7.0, 0.7.1, 0.7.2, 0.8.0, 0.8.1, 0.8.2, 0.8.3, 0.8.4, 0.8.6, 0.8.7, 0.8.8, 0.8.9, 0.8.10, 1.0.0
All unaffected versions: 0.7.5, 0.8.5, 0.8.11, 1.0.1, 1.0.2, 1.1.0, 1.1.1, 1.1.2