GitHub Advisoryadvisory · RubyGems

GHSA-65g2-x53q-cmf6 Sensitive Terraform Output Values Printed At Info Logging Level In Kitchen-Terraform

LOW Published 2023-04-24 Modified 2023-04-24 Official page ↗
Aliases
CVE-2023-30618
Ecosystem
RubyGems
Packages
kitchen-terraform
Severity
Low
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:L/I:N/A:N
Weaknesses
CWE-532
Reviewed
2023-04-24

Affected packages

• RubyGems kitchen-terraform: >= 7.0.0, < 7.0.1 → fixed in 7.0.1

Description

Summary Kitchen-Terraform v7.0.0 introduced a regression which caused all Terraform output values, including sensitive values, to be printed at the `info` logging level during the `kitchen converge` action. Prior to v7.0.0, the output values were printed at the `debug` level to avoid writing sensitive values to the terminal by default. Original Report @brettcurtis: > Hopefully, I'm not doing something stupid here, but I'm seeing sensitive outputs printed in the kitchen output. You can check this action for an example: https://github.com/osinfra-io/terraform-google-project/actions/runs/4700065515/jobs/8334277309#step:5:215 > > It's not really a sensitive value just used it as an example.

Related

Alias · CVE (1)

  • CVE-2023-30618 Kitchen-Terraform provides a set of Test Kitchen plugins which enable the use of Test Kitchen to converge a Terraform configuration and… vulnerability

Weakness · CWE (1)

  • CWE-532 Insertion of Sensitive Information into Log File weakness

References