fix(deps): update module github.com/rancher/wrangler to v0.8.11 [security]

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
github.com/rancher/wrangler	v0.8.7 -> v0.8.11

GitHub Vulnerability Alerts

CVE-2022-43756

Impact

A denial of services (DoS) vulnerability was discovered in Wrangler Git package affecting versions up to and including v1.0.0.

Specially crafted Git credentials can result in a denial of service (DoS) attack on an application that uses Wrangler due to the exhaustion of the available memory and CPU resources. This is caused by a lack of input validation of Git credentials before they are used, which may lead to a denial of service in some cases. This issue can be triggered when accessing both private and public Git repositories.

Workarounds

A workaround is to sanitize input passed to the Git package to remove potential unsafe and ambiguous characters. Otherwise, the best course of action is to update to a patched Wrangler version.

Patches

Patched versions include v1.0.1 and later and the backported tags - v0.7.4-security1, v0.8.5-security1 and v0.8.11.

For more information

If you have any questions or comments about this advisory:

• Reach out to SUSE Rancher Security team for security related inquiries.
• Open an issue in Rancher or Wrangler repository.
• Verify our support matrix and product support lifecycle.

CVE-2022-31249

Impact

A command injection vulnerability was discovered in Wrangler's Git package affecting versions up to and including v1.0.0.

Wrangler's Git package uses the underlying Git binary present in the host OS or container image to execute Git operations. Specially crafted commands can be passed to Wrangler that will change their behavior and cause confusion when executed through Git, resulting in command injection in the underlying host.

Workarounds

A workaround is to sanitize input passed to the Git package to remove potential unsafe and ambiguous characters. Otherwise, the best course of action is to update to a patched Wrangler version.

Patches

Patched versions include v1.0.1 and later and the backported tags - v0.7.4-security1, v0.8.5-security1 and v0.8.11.

For more information

If you have any questions or comments about this advisory:

• Reach out to SUSE Rancher Security team for security related inquiries.
• Open an issue in Rancher or Wrangler repository.
• Verify our support matrix and product support lifecycle.

---

Denial of service when processing Git credentials in github.com/rancher/wrangler

CVE-2022-43756 / GHSA-8fcj-gf77-47mg / GO-2023-1515

More information

Details

A denial of service (DoS) vulnerability exists in the Wrangler Git package. Specially crafted Git credentials can result in a denial of service (DoS) attack on an application that uses Wrangler due to the exhaustion of the available memory and CPU resources.

This is caused by a lack of input validation of Git credentials before they are used, which may lead to a denial of service in some cases. This issue can be triggered when accessing both private and public Git repositories.

A workaround is to sanitize input passed to the Git package to remove potential unsafe and ambiguous characters. Otherwise, the best course of action is to update to a patched Wrangler version.

Severity

Unknown

References

• https://github.com/rancher/wrangler/commit/341018c8fef3e12867c7cb2649bd2cecac75f287
• https://github.com/advisories/GHSA-8fcj-gf77-47mg
• https://github.com/rancher/rancher/security/policy

This data is provided by OSV and the Go Vulnerability Database (CC-BY 4.0).

---

Denial of service (DoS) when processing Git credentials

CVE-2022-43756 / GHSA-8fcj-gf77-47mg / GO-2023-1515

More information

Details

Impact

A denial of services (DoS) vulnerability was discovered in Wrangler Git package affecting versions up to and including v1.0.0.

Specially crafted Git credentials can result in a denial of service (DoS) attack on an application that uses Wrangler due to the exhaustion of the available memory and CPU resources. This is caused by a lack of input validation of Git credentials before they are used, which may lead to a denial of service in some cases. This issue can be triggered when accessing both private and public Git repositories.

Workarounds

A workaround is to sanitize input passed to the Git package to remove potential unsafe and ambiguous characters. Otherwise, the best course of action is to update to a patched Wrangler version.

Patches

Patched versions include v1.0.1 and later and the backported tags - v0.7.4-security1, v0.8.5-security1 and v0.8.11.

For more information

If you have any questions or comments about this advisory:

• Reach out to SUSE Rancher Security team for security related inquiries.
• Open an issue in Rancher or Wrangler repository.
• Verify our support matrix and product support lifecycle.

Severity

• CVSS Score: 5.9 / 10 (Medium)
• Vector String: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H

References

• https://github.com/rancher/wrangler/security/advisories/GHSA-8fcj-gf77-47mg
• https://nvd.nist.gov/vuln/detail/CVE-2022-43756
• https://github.com/rancher/wrangler/commit/341018c8fef3e12867c7cb2649bd2cecac75f287
• https://bugzilla.suse.com/show_bug.cgi?id=1205296
• https://github.com/advisories/GHSA-8fcj-gf77-47mg
• https://github.com/rancher/rancher/security/policy
• https://github.com/rancher/wrangler
• https://pkg.go.dev/vuln/GO-2023-1515

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

Command injection in Git package in Wrangler

CVE-2022-31249 / GHSA-qrg7-hfx7-95c5 / GO-2023-1519

More information

Details

Impact

A command injection vulnerability was discovered in Wrangler's Git package affecting versions up to and including v1.0.0.

Wrangler's Git package uses the underlying Git binary present in the host OS or container image to execute Git operations. Specially crafted commands can be passed to Wrangler that will change their behavior and cause confusion when executed through Git, resulting in command injection in the underlying host.

Workarounds

A workaround is to sanitize input passed to the Git package to remove potential unsafe and ambiguous characters. Otherwise, the best course of action is to update to a patched Wrangler version.

Patches

Patched versions include v1.0.1 and later and the backported tags - v0.7.4-security1, v0.8.5-security1 and v0.8.11.

For more information

If you have any questions or comments about this advisory:

• Reach out to SUSE Rancher Security team for security related inquiries.
• Open an issue in Rancher or Wrangler repository.
• Verify our support matrix and product support lifecycle.

Severity

• CVSS Score: 7.5 / 10 (High)
• Vector String: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

References

• https://github.com/rancher/wrangler/security/advisories/GHSA-qrg7-hfx7-95c5
• https://nvd.nist.gov/vuln/detail/CVE-2022-31249
• https://github.com/rancher/wrangler/commit/12397eec50155cb2d24aa70bdf9e90c5f3b9a727
• https://github.com/rancher/wrangler/commit/341018c8fef3e12867c7cb2649bd2cecac75f287
• https://github.com/rancher/wrangler/commit/5a387e13e8d51e3340d9e5012a1951f0cca5fc90
• https://github.com/rancher/wrangler/commit/8649ecc062204f28764fd80157a621cbae89c9cf
• https://bugzilla.suse.com/show_bug.cgi?id=1200299
• https://github.com/advisories/GHSA-qrg7-hfx7-95c5
• https://github.com/rancher/wrangler
• https://github.com/rancher/wrangler/compare/v0.7.2...v0.7.4-security1
• https://github.com/rancher/wrangler/compare/v0.8.4...v0.8.5-security1
• https://pkg.go.dev/vuln/GO-2023-1519

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

Command injection in github.com/rancher/wrangler

CVE-2022-31249 / GHSA-qrg7-hfx7-95c5 / GO-2023-1519

More information

Details

A command injection vulnerability exists in the Wrangler Git package. Specially crafted commands can be passed to Wrangler that will change their behavior and cause confusion when executed through Git, resulting in command injection in the underlying host.

A workaround is to sanitize input passed to the Git package to remove potential unsafe and ambiguous characters. Otherwise, the best course of action is to update to a patched Wrangler version.

Severity

Unknown

References

• https://github.com/advisories/GHSA-qrg7-hfx7-95c5

This data is provided by OSV and the Go Vulnerability Database (CC-BY 4.0).

---

Release Notes

rancher/wrangler (github.com/rancher/wrangler)

v0.8.11

Compare Source

v0.8.10

Compare Source

What's Changed

• Fixed distinct namespaces resolution in Apply by @​snasovich in #​187

Full Changelog: rancher/wrangler@v0.8.9...v0.8.10

v0.8.9

Compare Source

What's Changed

• fixed permissions errors when applying multiple namespaces by @​paynejacob in #​183

New Contributors

• @​paynejacob made their first contribution in #​183

Full Changelog: rancher/wrangler@v0.8.8...v0.8.9

v0.8.8

Compare Source

Added new signals pkg with shutdown func for windows services. The SetupSignalHandler now returns a channel so if you are using something like...

ctx := signals.SetupSignalHandler(context.Background())

There is now a func that returns the context that will do the context.Background call for you so switch to

ctx := signals.SetupSignalContext()

---

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.