Skip to content
OpenAdvisories
Medium · 6.7 CVE-2021-3035 EUVD-2021-26387GHSA-8cpg-gfv8-mrmw

Bridgecrew Checkov: Unsafe deserialization of Terraform files allows code execution

Published Apr 20, 2021 · Updated Sep 17, 2024 · Assigned by palo_alto

Vendor: Palo Alto Networks Product: Bridgecrew Checkov Category: Network devices

Description

An unsafe deserialization vulnerability in Bridgecrew Checkov by Prisma Cloud allows arbitrary code execution when processing a malicious terraform file. This issue impacts Checkov 2.0 versions earlier than Checkov 2.0.26. Checkov 1.0 versions are not impacted.

Affected products

VendorProductAffectedFixed
Palo Alto Networks Bridgecrew Checkov 2.0 – < 2.0.26 1.0 all

References