Summary
Ein entfernter, anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in Hashicorp Terraform ausnutzen, um Sicherheitsvorkehrungen zu umgehen und Daten zu manipulieren.
Product
Terraform ist ein Infrastruktur-als-Code-Tool.
Vulnerabilities 2
-
High 7.4
Vault Terraform Provider Applied Incorrect Defaults for LDAP Auth Method
Vault’s Terraform Provider incorrectly set the default deny_null_bind parameter for the LDAP auth method to false by default, potentially resulting in an insecure configuration. If the underlying LDAP server allowed anonymous or unauthenticated binds, this co…
-
Medium 4.3
Terraform Enterprise state versions can be created by users with specific permissions without sufficient write access
Terraform state versions can be created by a user with specific but insufficient permissions in a Terraform Enterprise workspace. This may allow for the alteration of infrastructure if a subsequent plan operation is approved by a user with approval permission…
Revision history
-
#1
Initiale Fassung
References
-
Hashicorp Security Advisory HCSEC-2025-33 vom 2025-11-23
https://discuss.hashicorp.com/t/hcsec-2025-33-vault-terraform-provider-applied-incorrect-defaults-for-ldap-auth-method/76822
-
Hashicorp Security Advisory HCSEC-2025-34 vom 2025-11-23
https://discuss.hashicorp.com/t/hcsec-2025-34-terraform-enterprise-state-versions-can-be-created-by-users-without-sufficient-write-access/76821