CVE-2022-43756: Rancher/Wrangler: Denial of service when processing Git credentials
A Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') vulnerability in SUSE Rancher allows remote attackers to cause denial of service by supplying specially crafted git credentials. This issue affects: SUSE Rancher wrangler version 0.7.3 and prior versions; wrangler version 0.8.4 and prior versions; wrangler version 1.0.0 and prior versions.
Affected Software
Event History
Frequently Asked Questions
What is the vulnerability ID for this issue?
The vulnerability ID for this issue is CVE-2022-43756.
What is the severity of CVE-2022-43756?
The severity of CVE-2022-43756 is high with a CVSS score of 7.5.
How does CVE-2022-43756 affect SUSE Rancher Wrangler?
CVE-2022-43756 affects SUSE Rancher Wrangler versions 0.7.3 and prior, and versions 0.8.0 to 0.8.5. It also affects version 1.0.0 of SUSE Rancher Wrangler.
How can remote attackers exploit CVE-2022-43756?
Remote attackers can exploit CVE-2022-43756 by supplying specially crafted git credentials, which can cause denial of service.
Is there a fix available for CVE-2022-43756?
Yes, a fix is available for CVE-2022-43756. It is recommended to upgrade to SUSE Rancher Wrangler version 0.7.4 or later for versions 0.7.x, version 0.8.6 or later for versions 0.8.x, and version 1.0.1 or later for version 1.0.0.