Medium WID-SEC-2023-2295 1 CVE

Hashicorp Terraform: Schwachstelle ermöglicht Manipulation von Dateien

Published Sep 10, 2023 · Updated Sep 10, 2023 · de-DE

Vendor: HashiCorp Product: Terraform < 1.5.7 Platform: Linux Platform: Windows

Summary

Ein lokaler Angreifer kann eine Schwachstelle in Hashicorp Terraform ausnutzen, um Dateien zu manipulieren.

Product

Terraform ist ein Infrastruktur-als-Code-Tool.

Vulnerabilities 1

Medium 6.3

CVE-2023-4782

Terraform Allows Arbitrary File Write During Init Operation

Terraform version 1.0.8 through 1.5.6 allows arbitrary file write during the `init` operation if run on maliciously crafted Terraform configuration. This vulnerability is fixed in Terraform 1.5.7.

HashiCorp Terraform terraform github.com/hashicorp/terraform Azure Linux Go

Sep 8, 2023

Revision history

2023-09-10 #1
Initiale Fassung

References

Hashicorp Security Advisory HCSEC-2023-27 vom 2023-09-10
https://discuss.hashicorp.com/t/hcsec-2023-27-terraform-allows-arbitrary-file-write-during-init-operation/58082