GHSA-8fcj-gf77-47mg

    Dashboard / Vulnerabilities / GHSA-8fcj-gf77-47mg

    GHSA-8fcj-gf77-47mg

    Published: 25 Jan 2023Last Modified: 8 Nov 2023

    Summary: Denial of service (DoS) when processing Git credentials

    Details: ### Impact A denial of services (DoS) vulnerability was discovered in Wrangler Git package affecting versions up to and including `v1.0.0`. Specially crafted Git credentials can result in a denial of service (DoS) attack on an application that uses Wrangler due to the exhaustion of the available memory and CPU resources. This is caused by a lack of input validation of Git credentials before they are used, which may lead to a denial of service in some cases. This issue can be triggered when accessing both private and public Git repositories. ### Workarounds A workaround is to sanitize input passed to the Git package to remove potential unsafe and ambiguous characters. Otherwise, the best course of action is to update to a patched Wrangler version. ### Patches Patched versions include `v1.0.1` and later and the backported tags - `v0.7.4-security1`, `v0.8.5-security1` and `v0.8.11`. ### For more information If you have any questions or comments about this advisory: * Reach out to [SUSE Rancher Security team](https://github.com/rancher/rancher/security/policy) for security related inquiries. * Open an issue in [Rancher](https://github.com/rancher/rancher/issues/new/choose) or [Wrangler](https://github.com/rancher/wrangler/issues/new) repository. * Verify our [support matrix](https://www.suse.com/suse-rancher/support-matrix/all-supported-versions/) and [product support lifecycle](https://www.suse.com/lifecycle/).

    References: https://github.com/rancher/wrangler/security/advisories/GHSA-8fcj-gf77-47mg, https://nvd.nist.gov/vuln/detail/CVE-2022-43756, https://github.com/rancher/wrangler/commit/341018c8fef3e12867c7cb2649bd2cecac75f287, https://bugzilla.suse.com/show_bug.cgi?id=1205296, https://github.com/advisories/GHSA-8fcj-gf77-47mg, https://github.com/rancher/rancher/security/policy, https://github.com/rancher/wrangler, https://pkg.go.dev/vuln/GO-2023-1515

    Affected packages

    Package

    Name: github.com/rancher/wrangler

    Purl: pkg:golang/github.com/rancher/wrangler

    Affected ranges

    Type: SEMVER

    Events:

    Introduced- 0
    Fixed -0.7.4-security1

    Affected versions

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High