PT-2023-1492 · Suse · Suse Rancher Wrangler

Guilherme Macedo · Publicado 2023-01-25 · Atualizado 2023-02-15 · CVE-2022-31249

Positive Technologies (AI Summary)

CVSS v2.0

10

Alta

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions SUSE Rancher wrangler versions 0.7.3 and prior versions SUSE Rancher wrangler versions 0.8.4 and prior versions SUSE Rancher wrangler versions 1.0.0 and prior versions

Description A command injection vulnerability exists in the Wrangler Git package, allowing remote attackers to inject commands in the underlying host via crafted commands passed to Wrangler. Specially crafted commands can be passed to Wrangler that will change their behavior and cause confusion when executed through Git, resulting in command injection in the underlying host.

Recommendations For SUSE Rancher wrangler versions 0.7.3 and prior versions, update to version 0.7.4-security1 or later. For SUSE Rancher wrangler versions 0.8.4 and prior versions, update to version 0.8.5-security1 or later. For SUSE Rancher wrangler versions 1.0.0 and prior versions, update to version 1.0.1 or later. As a temporary workaround, consider sanitizing input passed to the Git package to remove potential unsafe and ambiguous characters.

Correção

Argument Injection

OS Command Injection

Command Injection

Enumeração de Fraquezas

CWE-88

CWE-78

CWE-77

Identificadores relacionados

BDU:2023-00906

CVE-2022-31249

GHSA-QRG7-HFX7-95C5

GO-2023-1519

Produtos afetados

Suse Rancher Wrangler

Referências · 19

• https://github.com/rancher/wrangler/compare/v0.7.2...v0.7.4-security1 · Nota
• https://github.com/rancher/wrangler/compare/v0.8.4...v0.8.5-security1 · Nota
• https://github.com/rancher/wrangler/security/advisories/GHSA-qrg7-hfx7-95c5 · Nota
• https://github.com/rancher/wrangler · Nota
• https://github.com/rancher/wrangler/commit/5a387e13e8d51e3340d9e5012a1951f0cca5fc90 · Nota
• https://github.com/rancher/wrangler/commit/8649ecc062204f28764fd80157a621cbae89c9cf · Nota
• https://github.com/rancher/wrangler/commit/12397eec50155cb2d24aa70bdf9e90c5f3b9a727 · Nota
• https://github.com/rancher/wrangler/commit/341018c8fef3e12867c7cb2649bd2cecac75f287 · Nota
• https://osv.dev/vulnerability/GO-2023-1519 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-qrg7-hfx7-95c5 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2022-31249 · Nota de Segurança
• https://bugzilla.suse.com/show_bug.cgi?id=1200299 · Nota
• https://pkg.go.dev/vuln/GO-2023-1519 · Nota
• https://github.com/advisories/GHSA-qrg7-hfx7-95c5 · Nota
• https://t.me/cvenotify/43781 · Publicação no Telegram