UpHeron
All vulnerabilities

Servers and applications

CVE-2022-43758

Command injection in Rancher Git package

Severity
Medium 6.8
Published
25 Jan 2023
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Fixed in
2.5.17, 2.6.10, 2.7.1
Also known as
GHSA-34p5-jp77-fcrc
Sources
NVD, Project advisories (GitHub)

Description

A Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in SUSE Rancher allows code execution for user with the ability to add an untrusted Helm catalog or modifying the URL configuration used to download KDM (only admin users by default) This issue affects: SUSE Rancher Rancher versions prior to 2.5.17; Rancher versions prior to 2.6.10; Rancher…

Affected software

SoftwareAffected versions
RancherServers and applications · cpe:a:suse:rancher
  • From 2.5.0 before 2.5.17
  • From 2.6.0 before 2.6.10
  • From 2.7.0 before 2.7.1
RancherServers and applications · github:rancher/rancher
  • From 2.5.0 before 2.5.17
  • From 2.6.0 before 2.6.10
  • From 2.7.0 before 2.7.1

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2022-43758
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2022-43758
  • GitHub Advisory Database https://github.com/advisories/GHSA-34p5-jp77-fcrc
  • github.com https://github.com/rancher/rancher/security/advisories/GHSA-34p5-jp77-fcrc