GitHub Advisoryadvisory · Go
GHSA-r48h-jr2j-9g78 HashiCorp Terraform Amazon Web Services (AWS) uses an insecure PRNG
CRITICAL
Official page ↗
- Aliases
- CVE-2018-9057
- Ecosystem
- Go
- Packages
- github.com/hashicorp/terraform-provider-aws
- Severity
- Critical
- CVSS vector
- CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Weaknesses
- CWE-332
- Reviewed
- 2024-02-21
Affected packages
• Go github.com/hashicorp/terraform-provider-aws: < 1.14.0 → fixed in 1.14.0
Description
aws/resource_aws_iam_user_login_profile.go in the HashiCorp Terraform Amazon Web Services (AWS) provider through v1.12.0 has an inappropriate PRNG algorithm and seeding, which makes it easier for remote attackers to obtain access by leveraging an IAM account that was provisioned with a weak password.
Related
Alias · CVE (1)
- CVE-2018-9057 aws/resource_aws_iam_user_login_profile.go in the HashiCorp Terraform Amazon Web Services (AWS) provider through v1.12.0 has an… vulnerability
Weakness · CWE (1)
- CWE-332 Insufficient Entropy in PRNG weakness
References
- https://nvd.nist.gov/vuln/detail/CVE-2018-9057 advisory
- https://github.com/hashicorp/terraform-provider-aws/pull/3934 web
- https://github.com/hashicorp/terraform-provider-aws/pull/3989 web
- https://github.com/terraform-providers/terraform-provider-aws/pull/3934 web
- https://github.com/hashicorp/terraform-provider-aws/commit/efa8cd45c6484ff70b2a515ea7ff06f2459d4ddf web
- https://github.com/hashicorp/terraform-provider-aws package
- https://github.com/hashicorp/terraform-provider-aws/blob/02b039aa82dd7fc6e4a97a0922cc5dbbab724021/resource_aws_iam_user_login_profile.go#L70-L80 web