CVE-2022-43758: Github.com/rancher/rancher Command Injection Vulnerability

{
  "schema_version" : "1.4.0",
  "id" : "GHSA-34p5-jp77-fcrc",
  "modified" : "2023-02-15T18:37:48Z",
  "published" : "2023-01-25T19:36:35Z",
  "aliases" : [ "CVE-2022-43758" ],
  "summary" : "Command injection in Rancher Git package",
  "details" : "### Impact\n\nAn issue was discovered in Rancher from versions 2.5.0 up to and including 2.5.16, 2.6.0 up to and including 2.6.9 and 2.7.0, where a command injection vulnerability is present in the Rancher Git package. This package uses the underlying Git binary available in the Rancher container image to execute Git operations.\n\nSpecially crafted commands, when not properly disambiguated, can cause confusion when executed through Git, resulting in command injection in the underlying Rancher host.\n\nThis issue can potentially be exploited in Rancher in two ways:\n\n1. Adding an untrusted Helm catalog, in the Catalogs menu, that contains maliciously designed repo URL configuration in Helm charts.\n2. Modifying the URL configuration used to download KDM (Kontainer Driver Metadata) releases.\n\nBy default, only the Rancher admin has permission to manage both configurations for the local cluster (the cluster where Rancher is provisioned).\n\nNote: More information about this category of issue in version control system (VCS) tools are available in Snyk's [blog post](https://snyk.io/blog/argument-injection-when-using-git-and-mercurial/).\n\n### Workarounds\n\nExcept for only adding trusted catalogs and the KDM URL to Rancher, there is no other workaround besides updating Rancher to a patched version.\n\n### Patches\n\nPatched versions include releases 2.5.17, 2.6.10, 2.7.1 and later versions.\n\nIt is also important to update to a patched version in case Rancher or its standalone Git package implementation is used as a Go library instead of the application itself. Otherwise, this vulnerability might affect your dependent code.\n\n### For more information\n\nIf you have any questions or comments about this advisory:\n\n* Reach out to [SUSE Rancher Security team](https://github.com/rancher/rancher/security/policy) for security related inquiries.\n* Open an issue in [Rancher](https://github.com/rancher/rancher/issues/new/choose) repository.\n* Verify our [support matrix](https://www.suse.com/suse-rancher/support-matrix/all-supported-versions/) and [product support lifecycle](https://www.suse.com/lifecycle/).",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "Go",
      "name" : "github.com/rancher/rancher"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "2.5.0"
      }, {
        "fixed" : "2.5.17"
      } ]
    } ]
  }, {
    "package" : {
      "ecosystem" : "Go",
      "name" : "github.com/rancher/rancher"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "2.6.0"
      }, {
        "fixed" : "2.6.10"
      } ]
    } ]
  }, {
    "package" : {
      "ecosystem" : "Go",
      "name" : "github.com/rancher/rancher"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "2.7.0"
      }, {
        "fixed" : "2.7.1"
      } ]
    } ]
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/rancher/rancher/security/advisories/GHSA-34p5-jp77-fcrc"
  }, {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2022-43758"
  }, {
    "type" : "WEB",
    "url" : "https://bugzilla.suse.com/show_bug.cgi?id=1205294"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/rancher/rancher"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-77", "CWE-78", "CWE-88" ],
    "severity" : "MODERATE",
    "github_reviewed" : true,
    "github_reviewed_at" : "2023-01-25T19:36:35Z",
    "nvd_published_at" : "2023-02-07T13:15:00Z"
  }
}