CVE-2022-43758: 
Rancher vulnerability analysis and mitigation

A command injection vulnerability (CVE-2022-43758) was discovered in SUSE Rancher that allows code execution for users with the ability to add an untrusted Helm catalog or modify the URL configuration used to download KDM. This vulnerability affects SUSE Rancher versions prior to 2.5.17, 2.6.10, and 2.7.1 (SUSE Bugzilla, CVE Mitre).

The vulnerability is classified as an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection'). The attack vector is network-based, requiring high attack complexity and high privileges. The vulnerability also requires user interaction and has the potential to affect system scope (NVD CVSS).

If successfully exploited, this vulnerability can lead to high impacts on confidentiality, integrity, and availability of the affected system (NVD CVSS).

The vulnerability requires high privileges (typically admin access by default) and user interaction to be exploited. The attack must be launched through the network, though it requires high complexity to execute successfully (NVD CVSS).

The vulnerability has been patched in SUSE Rancher versions 2.5.17, 2.6.10, and 2.7.1. Users are advised to upgrade to these or later versions to mitigate the risk (SUSE Bugzilla).