CVE-2022-43756 - Vulnerability Details

Vendors	Products
Suse	Wrangler

Link	Providers
https://bugzilla.suse.com/show_bug.cgi?id=1205296

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Show plain JSON

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"state": "PUBLISHED", "cveId": "CVE-2022-43756", "assignerOrgId": "404e59f5-483d-4b8a-8e7a-e67604dd8afb", "assignerShortName": "suse", "dateUpdated": "2025-03-25T15:37:21.661Z", "dateReserved": "2022-10-26T00:00:00.000Z", "datePublished": "2023-02-07T00:00:00.000Z"}, "containers": {"cna": {"title": "Rancher/Wrangler: Denial of service when processing Git credentials", "datePublic": "2023-01-25T00:00:00.000Z", "providerMetadata": {"orgId": "404e59f5-483d-4b8a-8e7a-e67604dd8afb", "shortName": "suse", "dateUpdated": "2023-02-07T00:00:00.000Z"}, "descriptions": [{"lang": "en", "value": "A Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') vulnerability in SUSE Rancher allows remote attackers to cause denial of service by supplying specially crafted git credentials. This issue affects: SUSE Rancher wrangler version 0.7.3 and prior versions; wrangler version 0.8.4 and prior versions; wrangler version 1.0.0 and prior versions."}], "affected": [{"vendor": "SUSE", "product": "Rancher", "versions": [{"version": "wrangler", "status": "affected", "lessThanOrEqual": "0.7.3", "versionType": "custom"}]}], "references": [{"url": "https://bugzilla.suse.com/show_bug.cgi?id=1205296"}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H", "attackVector": "NETWORK", "attackComplexity": "HIGH", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "availabilityImpact": "HIGH", "baseScore": 5.9, "baseSeverity": "MEDIUM"}}], "problemTypes": [{"descriptions": [{"type": "CWE", "lang": "en", "description": "CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')", "cweId": "CWE-74"}]}], "x_generator": {"engine": "Vulnogram 0.0.9"}, "source": {"advisory": "https://bugzilla.suse.com/show_bug.cgi?id=1205296", "defect": ["1205296"], "discovery": "INTERNAL"}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T13:40:06.577Z"}, "title": "CVE Program Container", "references": [{"url": "https://bugzilla.suse.com/show_bug.cgi?id=1205296", "tags": ["x_transferred"]}]}, {"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-03-25T15:37:14.421155Z", "id": "CVE-2022-43756", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-03-25T15:37:21.661Z"}}]}}

{

dataType : CVE_RECORD (string)

dataVersion : 5.1 (string)

cveMetadata : { »

state : PUBLISHED (string)

cveId : CVE-2022-43756 (string)

assignerOrgId : 404e59f5-483d-4b8a-8e7a-e67604dd8afb (string)

assignerShortName : suse (string)

dateUpdated : 2025-03-25T15:37:21.661Z (string)

dateReserved : 2022-10-26T00:00:00.000Z (string)

datePublished : 2023-02-07T00:00:00.000Z (string)

}

containers : { »

cna : { »

title : Rancher/Wrangler: Denial of service when processing Git credentials (string)

datePublic : 2023-01-25T00:00:00.000Z (string)

providerMetadata : { »

orgId : 404e59f5-483d-4b8a-8e7a-e67604dd8afb (string)

shortName : suse (string)

dateUpdated : 2023-02-07T00:00:00.000Z (string)

}

descriptions : [ »

0 : { »

lang : en (string)

value : A Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') vulnerability in SUSE Rancher allows remote attackers to cause denial of service by supplying specially crafted git credentials. This issue affects: SUSE Rancher wrangler version 0.7.3 and prior versions; wrangler version 0.8.4 and prior versions; wrangler version 1.0.0 and prior versions. (string)

}

]

affected : [ »

0 : { »

vendor : SUSE (string)

product : Rancher (string)

versions : [ »

0 : { »

version : wrangler (string)

status : affected (string)

lessThanOrEqual : 0.7.3 (string)

versionType : custom (string)

}

]

}

]

references : [ »

0 : { »

url : https://bugzilla.suse.com/show_bug.cgi?id=1205296 (string)

}

]

metrics : [ »

0 : { »

cvssV3_1 : { »

version : 3.1 (string)

vectorString : CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H (string)

attackVector : NETWORK (string)

attackComplexity : HIGH (string)

privilegesRequired : LOW (string)

userInteraction : NONE (string)

scope : UNCHANGED (string)

confidentialityImpact : NONE (string)

integrityImpact : LOW (string)

availabilityImpact : HIGH (string)

baseScore : 5.9 (number)

baseSeverity : MEDIUM (string)

}

]

problemTypes : [ »

0 : { »

descriptions : [ »

0 : { »

type : CWE (string)

lang : en (string)

description : CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') (string)

cweId : CWE-74 (string)

}

]

}

]

x_generator : { »

engine : Vulnogram 0.0.9 (string)

}

source : { »

advisory : https://bugzilla.suse.com/show_bug.cgi?id=1205296 (string)

defect : [ »

0 : 1205296 (string)

]

discovery : INTERNAL (string)

}

adp : [ »

0 : { »

providerMetadata : { »

orgId : af854a3a-2127-422b-91ae-364da2661108 (string)

shortName : CVE (string)

dateUpdated : 2024-08-03T13:40:06.577Z (string)

}

title : CVE Program Container (string)

references : [ »

0 : { »

url : https://bugzilla.suse.com/show_bug.cgi?id=1205296 (string)

tags : [ »

0 : x_transferred (string)

]

}

]

}

1 : { »

metrics : [ »

0 : { »

other : { »

type : ssvc (string)

content : { »

timestamp : 2025-03-25T15:37:14.421155Z (string)

id : CVE-2022-43756 (string)

options : [ »

0 : { »

Exploitation : none (string)

}

1 : { »

Automatable : no (string)

}

2 : { »

Technical Impact : partial (string)

}

]

role : CISA Coordinator (string)

version : 2.0.3 (string)

}

]

title : CISA ADP Vulnrichment (string)

providerMetadata : { »

orgId : 134c704f-9b21-4f2e-91b3-4a467353bcc0 (string)

shortName : CISA-ADP (string)

dateUpdated : 2025-03-25T15:37:21.661Z (string)

}

]

}

Show plain JSON

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://bugzilla.suse.com/show_bug.cgi?id=1205296", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T13:40:06.577Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2022-43756", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-03-25T15:37:14.421155Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-03-25T15:37:17.952Z"}}], "cna": {"title": "Rancher/Wrangler: Denial of service when processing Git credentials", "source": {"defect": ["1205296"], "advisory": "https://bugzilla.suse.com/show_bug.cgi?id=1205296", "discovery": "INTERNAL"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.9, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "SUSE", "product": "Rancher", "versions": [{"status": "affected", "version": "wrangler", "versionType": "custom", "lessThanOrEqual": "0.7.3"}]}], "datePublic": "2023-01-25T00:00:00.000Z", "references": [{"url": "https://bugzilla.suse.com/show_bug.cgi?id=1205296"}], "x_generator": {"engine": "Vulnogram 0.0.9"}, "descriptions": [{"lang": "en", "value": "A Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') vulnerability in SUSE Rancher allows remote attackers to cause denial of service by supplying specially crafted git credentials. This issue affects: SUSE Rancher wrangler version 0.7.3 and prior versions; wrangler version 0.8.4 and prior versions; wrangler version 1.0.0 and prior versions."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-74", "description": "CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')"}]}], "providerMetadata": {"orgId": "404e59f5-483d-4b8a-8e7a-e67604dd8afb", "shortName": "suse", "dateUpdated": "2023-02-07T00:00:00.000Z"}}}, "cveMetadata": {"cveId": "CVE-2022-43756", "state": "PUBLISHED", "dateUpdated": "2025-03-25T15:37:21.661Z", "dateReserved": "2022-10-26T00:00:00.000Z", "assignerOrgId": "404e59f5-483d-4b8a-8e7a-e67604dd8afb", "datePublished": "2023-02-07T00:00:00.000Z", "assignerShortName": "suse"}, "dataVersion": "5.1"}

{

dataType : CVE_RECORD (string)

containers : { »

adp : [ »

0 : { »

title : CVE Program Container (string)

references : [ »

0 : { »

url : https://bugzilla.suse.com/show_bug.cgi?id=1205296 (string)

tags : [ »

0 : x_transferred (string)

]

}

]

providerMetadata : { »

orgId : af854a3a-2127-422b-91ae-364da2661108 (string)

shortName : CVE (string)

dateUpdated : 2024-08-03T13:40:06.577Z (string)

}

1 : { »

title : CISA ADP Vulnrichment (string)

metrics : [ »

0 : { »

other : { »

type : ssvc (string)

content : { »

id : CVE-2022-43756 (string)

role : CISA Coordinator (string)

options : [ »

0 : { »

Exploitation : none (string)

}

1 : { »

Automatable : no (string)

}

2 : { »

Technical Impact : partial (string)

}

]

version : 2.0.3 (string)

timestamp : 2025-03-25T15:37:14.421155Z (string)

}

]

providerMetadata : { »

orgId : 134c704f-9b21-4f2e-91b3-4a467353bcc0 (string)

shortName : CISA-ADP (string)

dateUpdated : 2025-03-25T15:37:17.952Z (string)

}

]

cna : { »

title : Rancher/Wrangler: Denial of service when processing Git credentials (string)

source : { »

defect : [ »

0 : 1205296 (string)

]

advisory : https://bugzilla.suse.com/show_bug.cgi?id=1205296 (string)

discovery : INTERNAL (string)

}

metrics : [ »

0 : { »

cvssV3_1 : { »

scope : UNCHANGED (string)

version : 3.1 (string)

baseScore : 5.9 (number)

attackVector : NETWORK (string)

baseSeverity : MEDIUM (string)

vectorString : CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H (string)

integrityImpact : LOW (string)

userInteraction : NONE (string)

attackComplexity : HIGH (string)

availabilityImpact : HIGH (string)

privilegesRequired : LOW (string)

confidentialityImpact : NONE (string)

}

]

affected : [ »

0 : { »

vendor : SUSE (string)

product : Rancher (string)

versions : [ »

0 : { »

status : affected (string)

version : wrangler (string)

versionType : custom (string)

lessThanOrEqual : 0.7.3 (string)

}

]

}

]

datePublic : 2023-01-25T00:00:00.000Z (string)

references : [ »

0 : { »

url : https://bugzilla.suse.com/show_bug.cgi?id=1205296 (string)

}

]

x_generator : { »

engine : Vulnogram 0.0.9 (string)

}

descriptions : [ »

0 : { »

lang : en (string)

value : A Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') vulnerability in SUSE Rancher allows remote attackers to cause denial of service by supplying specially crafted git credentials. This issue affects: SUSE Rancher wrangler version 0.7.3 and prior versions; wrangler version 0.8.4 and prior versions; wrangler version 1.0.0 and prior versions. (string)

}

]

problemTypes : [ »

0 : { »

descriptions : [ »

0 : { »

lang : en (string)

type : CWE (string)

cweId : CWE-74 (string)

description : CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') (string)

}

]

}

]

providerMetadata : { »

orgId : 404e59f5-483d-4b8a-8e7a-e67604dd8afb (string)

shortName : suse (string)

dateUpdated : 2023-02-07T00:00:00.000Z (string)

}

cveMetadata : { »

cveId : CVE-2022-43756 (string)

state : PUBLISHED (string)

dateUpdated : 2025-03-25T15:37:21.661Z (string)

dateReserved : 2022-10-26T00:00:00.000Z (string)

assignerOrgId : 404e59f5-483d-4b8a-8e7a-e67604dd8afb (string)

datePublished : 2023-02-07T00:00:00.000Z (string)

assignerShortName : suse (string)

}

dataVersion : 5.1 (string)

}

Show plain JSON

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:suse:wrangler:*:*:*:*:*:*:*:*", "matchCriteriaId": "46C3F368-99A7-4B09-B53F-0D57D8E76422", "versionEndExcluding": "0.7.4", "vulnerable": true}, {"criteria": "cpe:2.3:a:suse:wrangler:*:*:*:*:*:*:*:*", "matchCriteriaId": "79667660-A783-43C5-9BD1-6EDBA0B2C61C", "versionEndExcluding": "0.8.5", "versionStartIncluding": "0.8.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:suse:wrangler:1.0.0:*:*:*:*:*:*:*", "matchCriteriaId": "73F2D72A-9CDA-4823-BA12-0A4468536CFE", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "A Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') vulnerability in SUSE Rancher allows remote attackers to cause denial of service by supplying specially crafted git credentials. This issue affects: SUSE Rancher wrangler version 0.7.3 and prior versions; wrangler version 0.8.4 and prior versions; wrangler version 1.0.0 and prior versions."}], "id": "CVE-2022-43756", "lastModified": "2024-11-21T07:27:10.023", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 5.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H", "version": "3.1"}, "exploitabilityScore": 1.6, "impactScore": 4.2, "source": "meissner@suse.de", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2023-02-07T13:15:09.717", "references": [{"source": "meissner@suse.de", "tags": ["Issue Tracking", "Mitigation"], "url": "https://bugzilla.suse.com/show_bug.cgi?id=1205296"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Issue Tracking", "Mitigation"], "url": "https://bugzilla.suse.com/show_bug.cgi?id=1205296"}], "sourceIdentifier": "meissner@suse.de", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-74"}], "source": "meissner@suse.de", "type": "Secondary"}]}

{

configurations : [ »

0 : { »

nodes : [ »

0 : { »

cpeMatch : [ »

0 : { »

criteria : cpe:2.3:a:suse:wrangler:*:*:*:*:*:*:*:* (string)

matchCriteriaId : 46C3F368-99A7-4B09-B53F-0D57D8E76422 (string)

versionEndExcluding : 0.7.4 (string)

vulnerable : true (boolean)

}

1 : { »

criteria : cpe:2.3:a:suse:wrangler:*:*:*:*:*:*:*:* (string)

matchCriteriaId : 79667660-A783-43C5-9BD1-6EDBA0B2C61C (string)

versionEndExcluding : 0.8.5 (string)

versionStartIncluding : 0.8.0 (string)

vulnerable : true (boolean)

}

2 : { »

criteria : cpe:2.3:a:suse:wrangler:1.0.0:*:*:*:*:*:*:* (string)

matchCriteriaId : 73F2D72A-9CDA-4823-BA12-0A4468536CFE (string)

vulnerable : true (boolean)

}

]

negate : false (boolean)

operator : OR (string)

}

]

}

]

descriptions : [ »

0 : { »

lang : en (string)

value : A Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') vulnerability in SUSE Rancher allows remote attackers to cause denial of service by supplying specially crafted git credentials. This issue affects: SUSE Rancher wrangler version 0.7.3 and prior versions; wrangler version 0.8.4 and prior versions; wrangler version 1.0.0 and prior versions. (string)

}

]

id : CVE-2022-43756 (string)

lastModified : 2024-11-21T07:27:10.023 (string)

metrics : { »

cvssMetricV31 : [ »

0 : { »

cvssData : { »

attackComplexity : HIGH (string)

attackVector : NETWORK (string)

availabilityImpact : HIGH (string)

baseScore : 5.9 (number)

baseSeverity : MEDIUM (string)

confidentialityImpact : NONE (string)

integrityImpact : LOW (string)

privilegesRequired : LOW (string)

scope : UNCHANGED (string)

userInteraction : NONE (string)

vectorString : CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H (string)

version : 3.1 (string)

}

exploitabilityScore : 1.6 (number)

impactScore : 4.2 (number)

source : meissner@suse.de (string)

type : Secondary (string)

}

1 : { »

cvssData : { »

attackComplexity : LOW (string)

attackVector : NETWORK (string)

availabilityImpact : HIGH (string)

baseScore : 7.5 (number)

baseSeverity : HIGH (string)

confidentialityImpact : NONE (string)

integrityImpact : NONE (string)

privilegesRequired : NONE (string)

scope : UNCHANGED (string)

userInteraction : NONE (string)

vectorString : CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (string)

version : 3.1 (string)

}

exploitabilityScore : 3.9 (number)

impactScore : 3.6 (number)

source : nvd@nist.gov (string)

type : Primary (string)

}

]

}

published : 2023-02-07T13:15:09.717 (string)

references : [ »

0 : { »

source : meissner@suse.de (string)

tags : [ »

0 : Issue Tracking (string)

1 : Mitigation (string)

]

url : https://bugzilla.suse.com/show_bug.cgi?id=1205296 (string)

}

1 : { »

source : af854a3a-2127-422b-91ae-364da2661108 (string)

tags : [ »

0 : Issue Tracking (string)

1 : Mitigation (string)

]

url : https://bugzilla.suse.com/show_bug.cgi?id=1205296 (string)

}

]

sourceIdentifier : meissner@suse.de (string)

vulnStatus : Modified (string)

weaknesses : [ »

0 : { »

description : [ »

0 : { »

lang : en (string)

value : CWE-74 (string)

}

]

source : meissner@suse.de (string)

type : Secondary (string)

}

]

}

Metrics

Attack Vector Network

Attack Complexity High

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact Low

Availability Impact High

User Interaction None

Exploitation none

Automatable no

Technical Impact partial

Affected Vendors & Products

Metrics

Attack Vector Network

Attack Complexity High

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact Low

Availability Impact High

User Interaction None

Exploitation none

Automatable no

Technical Impact partial

Affected Vendors & Products

JSON object

JSON object

JSON object

JSON object