Information Exposure Affecting kitchen-terraform package, versions >=7.0.0, <7.0.1
Threat Intelligence
EPSS
0.04% (11th
percentile)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-RUBY-KITCHENTERRAFORM-5457851
- published 23 Apr 2023
- disclosed 23 Apr 2023
- credit brettcurtis
Introduced: 23 Apr 2023
CVE-2023-30618 Open this link in a new tabHow to fix?
Upgrade kitchen-terraform to version 7.0.1 or higher.
Overview
kitchen-terraform is a set of Test Kitchen plugins for testing Terraform configuration.
Affected versions of this package are vulnerable to Information Exposure due to a regression that caused all Terraform output values, including sensitive values, to be printed at the info logging level during the kitchen converge action. An attacker would need access to the local machine in order to gain access to these logs during an operation.
References
CVSS Scores
version 3.1