PT-2023-1492 · Suse · Suse Rancher Wrangler

Guilherme Macedo · Published 2023-01-25 · Updated 2023-02-15 · CVE-2022-31249

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions SUSE Rancher wrangler versions 0.7.3 and prior versions SUSE Rancher wrangler versions 0.8.4 and prior versions SUSE Rancher wrangler versions 1.0.0 and prior versions

Description A command injection vulnerability exists in the Wrangler Git package, allowing remote attackers to inject commands in the underlying host via crafted commands passed to Wrangler. Specially crafted commands can be passed to Wrangler that will change their behavior and cause confusion when executed through Git, resulting in command injection in the underlying host.

Recommendations For SUSE Rancher wrangler versions 0.7.3 and prior versions, update to version 0.7.4-security1 or later. For SUSE Rancher wrangler versions 0.8.4 and prior versions, update to version 0.8.5-security1 or later. For SUSE Rancher wrangler versions 1.0.0 and prior versions, update to version 1.0.1 or later. As a temporary workaround, consider sanitizing input passed to the Git package to remove potential unsafe and ambiguous characters.

Fix

Argument Injection

OS Command Injection

Command Injection

Weakness Enumeration

CWE-88

CWE-78

CWE-77

Related Identifiers

BDU:2023-00906

CVE-2022-31249

GHSA-QRG7-HFX7-95C5

GO-2023-1519

Affected Products

Suse Rancher Wrangler

References · 19

• https://osv.dev/vulnerability/GO-2023-1519 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-qrg7-hfx7-95c5 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-31249 · Security Note
• https://osv.dev/vulnerability/CVE-2022-31249 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-00906 · Security Note
• https://github.com/rancher/wrangler/compare/v0.7.2...v0.7.4-security1 · Note
• https://github.com/rancher/wrangler/compare/v0.8.4...v0.8.5-security1 · Note
• https://github.com/rancher/wrangler/security/advisories/GHSA-qrg7-hfx7-95c5 · Note
• https://github.com/rancher/wrangler · Note
• https://github.com/rancher/wrangler/commit/5a387e13e8d51e3340d9e5012a1951f0cca5fc90 · Note
• https://github.com/rancher/wrangler/commit/8649ecc062204f28764fd80157a621cbae89c9cf · Note
• https://github.com/rancher/wrangler/commit/12397eec50155cb2d24aa70bdf9e90c5f3b9a727 · Note
• https://github.com/rancher/wrangler/commit/341018c8fef3e12867c7cb2649bd2cecac75f287 · Note
• https://bugzilla.suse.com/show_bug.cgi?id=1200299 · Note
• https://pkg.go.dev/vuln/GO-2023-1519 · Note