{"id":"CVE-2022-43756","aliases":["EUVD-2023-0407","GHSA-8fcj-gf77-47mg","GO-2023-1515"],"status":"published","title":"Rancher/Wrangler: Denial of service when processing Git credentials","description":"A Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') vulnerability in SUSE Rancher allows remote attackers to cause denial of service by supplying specially crafted git credentials. This issue affects: SUSE Rancher wrangler version 0.7.3 and prior versions; wrangler version 0.8.4 and prior versions; wrangler version 1.0.0 and prior versions.","severity":{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00684,"percentile":0.52902,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-150","CWE-74"],"published":"2023-01-25T19:40:26Z","modified":"2026-10-28T02:31:09Z","fixes":[{"ecosystem":"Go","package":"github.com/rancher/wrangler","fixed_in":["0.7.4-security1","0.8.5-security1","1.0.1","0.8.11"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Go","package":"github.com/rancher/wrangler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"0.7.3"},{"fixed":"0.7.4-security1"}]}]},{"source":"ghsa","ecosystem":"Go","package":"github.com/rancher/wrangler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.8.0"},{"last_affected":"0.8.4"},{"fixed":"0.8.5-security1"}]}]},{"source":"ghsa","ecosystem":"Go","package":"github.com/rancher/wrangler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.0"},{"last_affected":"1.0.0"},{"fixed":"1.0.1"}]}],"versions":["1.0.0"]},{"source":"ghsa","ecosystem":"Go","package":"github.com/rancher/wrangler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.8.6"},{"fixed":"0.8.11"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/rancher/wrangler","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.7.4-security1"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/rancher/wrangler","ranges":[{"type":"SEMVER","events":[{"introduced":"0.8.0"},{"fixed":"0.8.5-security1"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/rancher/wrangler","ranges":[{"type":"SEMVER","events":[{"introduced":"1.0.0"},{"fixed":"1.0.1"}]}],"versions":["1.0.0"]},{"source":"osv","ecosystem":"Go","package":"github.com/rancher/wrangler","ranges":[{"type":"SEMVER","events":[{"introduced":"0.8.6"},{"fixed":"0.8.11"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/rancher/wrangler","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.7.4-security1"},{"introduced":"0.8.0"},{"fixed":"0.8.5-security1"},{"introduced":"0.8.6"},{"fixed":"0.8.11"},{"introduced":"1.0.0"},{"fixed":"1.0.1"}]}]}],"products":[{"vendor":"suse","product":"rancher"},{"vendor":"suse","product":"wrangler"}],"references":[{"url":"https://bugzilla.suse.com/show_bug.cgi?id=1205296","tags":["x_transferred","Issue Tracking","Mitigation","report","web"]},{"url":"https://github.com/rancher/wrangler/security/advisories/GHSA-8fcj-gf77-47mg","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-43756","tags":["advisory"]},{"url":"https://github.com/rancher/wrangler/commit/341018c8fef3e12867c7cb2649bd2cecac75f287","tags":["web","fix"]},{"url":"https://github.com/advisories/GHSA-8fcj-gf77-47mg","tags":["advisory"]},{"url":"https://github.com/rancher/rancher/security/policy","tags":["web"]},{"url":"https://pkg.go.dev/vuln/GO-2023-1515","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/43xxx/CVE-2022-43756.json","tags":["advisory"]},{"url":"https://github.com/rancher/wrangler","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2022-43756","title":"Rancher/Wrangler: Denial of service when processing Git credentials","description":"A Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') vulnerability in SUSE Rancher allows remote attackers to cause denial of service by supplying specially crafted git credentials. This issue affects: SUSE Rancher wrangler version 0.7.3 and prior versions; wrangler version 0.8.4 and prior versions; wrangler version 1.0.0 and prior versions.","status":"published","published":"2023-02-07T00:00:00Z","modified":"2025-03-25T15:37:21.661Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H","level":"medium","assessor":"cna"}],"cwes":["CWE-74"],"updated_at":"2026-11-02T14:34:25.308772Z"}],"euvd":[{"id":"EUVD-2023-0407","description":"A Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') vulnerability in SUSE Rancher allows remote attackers to cause denial of service by supplying specially crafted git credentials. This issue affects: SUSE Rancher wrangler version 0.7.3 and prior versions; wrangler version 0.8.4 and prior versions; wrangler version 1.0.0 and prior versions.","status":"published","published":"2023-02-07T00:00:00Z","modified":"2025-03-25T15:37:21Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H","level":"medium"}],"updated_at":"2026-11-02T20:52:53.129601Z"}],"ghsa":[{"id":"GHSA-8fcj-gf77-47mg","title":"Denial of service (DoS) when processing Git credentials","description":"### Impact\n\nA denial of services (DoS) vulnerability was discovered in Wrangler Git package affecting versions up to and including `v1.0.0`.\n\nSpecially crafted Git credentials can result in a denial of service (DoS) attack on an application that uses Wrangler due to the exhaustion of the available memory and CPU resources. This is caused by a lack of input validation of Git credentials before they are used, which may lead to a denial of service in some cases. This issue can be triggered when accessing both private and public Git repositories. \n\n### Workarounds\n\nA workaround is to sanitize input passed to the Git package to remove potential unsafe and ambiguous characters. Otherwise, the best course of action is to update to a patched Wrangler version.\n\n### Patches\n\nPatched versions include `v1.0.1` and later and the backported tags - `v0.7.4-security1`, `v0.8.5-security1` and `v0.8.11`.\n\n### For more information\n\nIf you have any questions or comments about this advisory:\n\n* Reach out to [SUSE Rancher Security team](https://github.com/rancher/rancher/security/policy) for security related inquiries.\n* Open an issue in [Rancher](https://github.com/rancher/rancher/issues/new/choose) or [Wrangler](https://github.com/rancher/wrangler/issues/new) repository.\n* Verify our [support matrix](https://www.suse.com/suse-rancher/support-matrix/all-supported-versions/) and [product support lifecycle](https://www.suse.com/lifecycle/).","status":"published","published":"2023-01-25T19:40:26Z","modified":"2023-02-14T19:29:54Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H","level":"medium"}],"cwes":["CWE-74","CWE-150"],"updated_at":"2026-11-02T14:36:45.67005Z"}],"nvd":[{"id":"CVE-2022-43756","description":"A Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') vulnerability in SUSE Rancher allows remote attackers to cause denial of service by supplying specially crafted git credentials. This issue affects: SUSE Rancher wrangler version 0.7.3 and prior versions; wrangler version 0.8.4 and prior versions; wrangler version 1.0.0 and prior versions.","status":"published","published":"2023-02-07T13:15:09.717Z","modified":"2026-06-17T05:07:15.41Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H","level":"medium","assessor":"secondary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-74"],"updated_at":"2026-11-02T14:07:36.026349Z"}],"osv":[{"id":"CVE-2022-43756","title":"Rancher/Wrangler: Denial of service when processing Git credentials","description":"A Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') vulnerability in SUSE Rancher allows remote attackers to cause denial of service by supplying specially crafted git credentials. This issue affects: SUSE Rancher wrangler version 0.7.3 and prior versions; wrangler version 0.8.4 and prior versions; wrangler version 1.0.0 and prior versions.","status":"published","published":"2023-02-07T00:00:00Z","modified":"2026-10-28T02:31:09.107125084Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H","level":"medium"}],"cwes":["CWE-74"],"updated_at":"2026-11-02T15:44:27.186787Z"},{"id":"GHSA-8fcj-gf77-47mg","title":"Denial of service (DoS) when processing Git credentials","description":"### Impact\n\nA denial of services (DoS) vulnerability was discovered in Wrangler Git package affecting versions up to and including `v1.0.0`.\n\nSpecially crafted Git credentials can result in a denial of service (DoS) attack on an application that uses Wrangler due to the exhaustion of the available memory and CPU resources. This is caused by a lack of input validation of Git credentials before they are used, which may lead to a denial of service in some cases. This issue can be triggered when accessing both private and public Git repositories. \n\n### Workarounds\n\nA workaround is to sanitize input passed to the Git package to remove potential unsafe and ambiguous characters. Otherwise, the best course of action is to update to a patched Wrangler version.\n\n### Patches\n\nPatched versions include `v1.0.1` and later and the backported tags - `v0.7.4-security1`, `v0.8.5-security1` and `v0.8.11`.\n\n### For more information\n\nIf you have any questions or comments about this advisory:\n\n* Reach out to [SUSE Rancher Security team](https://github.com/rancher/rancher/security/policy) for security related inquiries.\n* Open an issue in [Rancher](https://github.com/rancher/rancher/issues/new/choose) or [Wrangler](https://github.com/rancher/wrangler/issues/new) repository.\n* Verify our [support matrix](https://www.suse.com/suse-rancher/support-matrix/all-supported-versions/) and [product support lifecycle](https://www.suse.com/lifecycle/).","status":"published","published":"2023-01-25T19:40:26Z","modified":"2023-11-08T04:10:46.341625Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H","level":"medium"}],"cwes":["CWE-150","CWE-74"],"updated_at":"2026-11-02T15:46:42.437513Z"},{"id":"GO-2023-1515","title":"Denial of service when processing Git credentials in github.com/rancher/wrangler","description":"A denial of service (DoS) vulnerability exists in the Wrangler Git package. Specially crafted Git credentials can result in a denial of service (DoS) attack on an application that uses Wrangler due to the exhaustion of the available memory and CPU resources.\n\nThis is caused by a lack of input validation of Git credentials before they are used, which may lead to a denial of service in some cases. This issue can be triggered when accessing both private and public Git repositories.\n\nA workaround is to sanitize input passed to the Git package to remove potential unsafe and ambiguous characters. Otherwise, the best course of action is to update to a patched Wrangler version.","status":"published","published":"2023-02-14T16:19:12Z","modified":"2024-05-20T16:03:47Z","updated_at":"2026-11-02T15:47:00.918515Z"}]}}