Описание
Command injection in Git package in Wrangler
Impact
A command injection vulnerability was discovered in Wrangler's Git package affecting versions up to and including v1.0.0.
Wrangler's Git package uses the underlying Git binary present in the host OS or container image to execute Git operations. Specially crafted commands can be passed to Wrangler that will change their behavior and cause confusion when executed through Git, resulting in command injection in the underlying host.
Workarounds
A workaround is to sanitize input passed to the Git package to remove potential unsafe and ambiguous characters. Otherwise, the best course of action is to update to a patched Wrangler version.
Patches
Patched versions include v1.0.1 and later and the backported tags - v0.7.4-security1, v0.8.5-security1 and v0.8.11.
For more information
If you have any questions or comments about this advisory:
- Reach out to SUSE Rancher Security team for security related inquiries.
- Open an issue in Rancher or Wrangler repository.
- Verify our support matrix and product support lifecycle.
Ссылки
- https://github.com/rancher/wrangler/security/advisories/GHSA-qrg7-hfx7-95c5
- https://nvd.nist.gov/vuln/detail/CVE-2022-31249
- https://github.com/rancher/wrangler/commit/12397eec50155cb2d24aa70bdf9e90c5f3b9a727
- https://github.com/rancher/wrangler/commit/341018c8fef3e12867c7cb2649bd2cecac75f287
- https://github.com/rancher/wrangler/commit/5a387e13e8d51e3340d9e5012a1951f0cca5fc90
- https://github.com/rancher/wrangler/commit/8649ecc062204f28764fd80157a621cbae89c9cf
- https://bugzilla.suse.com/show_bug.cgi?id=1200299
- https://github.com/advisories/GHSA-qrg7-hfx7-95c5
- https://github.com/rancher/wrangler/compare/v0.7.2...v0.7.4-security1
- https://github.com/rancher/wrangler/compare/v0.8.4...v0.8.5-security1
- https://pkg.go.dev/vuln/GO-2023-1519
Пакеты
github.com/rancher/wrangler
< 0.7.4-security1
0.7.4-security1
github.com/rancher/wrangler
>= 0.8.0, < 0.8.5-security1
0.8.5-security1
github.com/rancher/wrangler
= 1.0.0
1.0.1
github.com/rancher/wrangler
>= 0.8.6, < 0.8.11
0.8.11
Связанные уязвимости
A Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in wrangler of SUSE Rancher allows remote attackers to inject commands in the underlying host via crafted commands passed to Wrangler. This issue affects: SUSE Rancher wrangler version 0.7.3 and prior versions; wrangler version 0.8.4 and prior versions; wrangler version 1.0.0 and prior versions.
Уязвимость программной платформы для развертывания контейнеров в производственной среде SUSE Rancher wrangler, существующая из-за непринятия мер по нейтрализации специальных элементов, используемых в команде операционной системы, позволяющая нарушителю выполнить произвольные команды