Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
2 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
0.7.4-security10.8.5-security11.0.10.8.11· Vendor fix available
Issue
Impact A command injection vulnerability was discovered in Wrangler's Git package affecting versions up to and including v1.0.0. Wrangler's Git package uses the underlying Git binary present in the host OS or container image to execute Git operations. Specially crafted commands can be passed to Wrangler that will change their behavior and cause confusion when executed through Git, resulting in command injection in the underlying host. Workarounds A workaround is to sanitize input passed to the Git package to remove potential unsafe and ambiguous characters. Otherwise, the best course of action is to update to a patched Wrangler version. Patches Patched versions include v1.0.1 and later and the backported tags - v0.7.4-security1, v0.8.5-security1 and v0.8.11. For more information If you have any questions or comments about this advisory: Reach out to SUSE Rancher Security team for security related inquiries. Open an issue in Rancher or Wrangler repository. Verify our support matrix…
Recommended action: Upgrade to 1.0.1, 0.8.11, 0.8.5-security1 (pre-release) or 0.7.4-security1 (pre-release) by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
0.7.4-security10.8.5-security11.0.10.8.11· Vendor fix available
Issue
Impact A denial of services (DoS) vulnerability was discovered in Wrangler Git package affecting versions up to and including v1.0.0. Specially crafted Git credentials can result in a denial of service (DoS) attack on an application that uses Wrangler due to the exhaustion of the available memory and CPU resources. This is caused by a lack of input validation of Git credentials before they are used, which may lead to a denial of service in some cases. This issue can be triggered when accessing both private and public Git repositories. Workarounds A workaround is to sanitize input passed to the Git package to remove potential unsafe and ambiguous characters. Otherwise, the best course of action is to update to a patched Wrangler version. Patches Patched versions include v1.0.1 and later and the backported tags - v0.7.4-security1, v0.8.5-security1 and v0.8.11. For more information If you have any questions or comments about this advisory: Reach out to SUSE Rancher Security team for…
Recommended action: Upgrade to 1.0.1, 0.8.11, 0.8.5-security1 (pre-release) or 0.7.4-security1 (pre-release) by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.