Denial of service (DoS) when processing Git credentials
Package
Affected versions
<= 0.7.3
>= 0.8.0, <= 0.8.4
= 1.0.0
>= 0.8.6, < 0.8.11
Patched versions
0.7.4-security1
0.8.5-security1
1.0.1
0.8.11
Description
Published to the GitHub Advisory Database
Jan 25, 2023
Reviewed
Jan 25, 2023
Published by the National Vulnerability Database
Feb 7, 2023
Last updated
Feb 14, 2023
Impact
A denial of services (DoS) vulnerability was discovered in Wrangler Git package affecting versions up to and including
v1.0.0.Specially crafted Git credentials can result in a denial of service (DoS) attack on an application that uses Wrangler due to the exhaustion of the available memory and CPU resources. This is caused by a lack of input validation of Git credentials before they are used, which may lead to a denial of service in some cases. This issue can be triggered when accessing both private and public Git repositories.
Workarounds
A workaround is to sanitize input passed to the Git package to remove potential unsafe and ambiguous characters. Otherwise, the best course of action is to update to a patched Wrangler version.
Patches
Patched versions include
v1.0.1and later and the backported tags -v0.7.4-security1,v0.8.5-security1andv0.8.11.For more information
If you have any questions or comments about this advisory:
References