Description
When using the Azure backend with a shared access signature (SAS), Terraform versions prior to 0.12.17 may transmit the token and state snapshot using cleartext HTTP.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP1 | terraform | 0.12.19-3.6.1 | SUSE-SU-2020:0320-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | terraform | 0.14.10-1.12 | openSUSE-SU-2024:11429-1 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Go | github.com/hashicorp/terraform | < 0.12.17 | 0.12.17 | GHSA-h3p9-wrgx-82cm |
Advisories 2
- openSUSE-SU-2024:11429-1 terraform-0.14.10-1.12 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2020:0320-1 Security update for terraform SUSE / openSUSE Security Updates · Feb 4, 2026