PT-2018-18819 · Hashicorp · Hashicorp Terraform Amazon Web Services (Aws) Provider

Kellerfuchs · Published 2018-03-27 · Updated 2022-05-14 · CVE-2018-9057

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions HashiCorp Terraform Amazon Web Services (AWS) provider versions prior to v1.13.0, but since the exact fixed version is not specified, we consider versions prior to v1.12.0 as vulnerable, however the description only mentions through v1.12.0. HashiCorp Terraform Amazon Web Services (AWS) provider versions through v1.12.0

Description The issue is related to an inappropriate PRNG algorithm and seeding in the aws/resource aws iam user login profile.go file of the HashiCorp Terraform Amazon Web Services (AWS) provider. This makes it easier for remote attackers to obtain access by leveraging an IAM account that was provisioned with a weak password.

Recommendations For HashiCorp Terraform Amazon Web Services (AWS) provider versions through v1.12.0, consider updating to a version later than v1.12.0 to mitigate the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-332

Related Identifiers

CVE-2018-9057

GHSA-R48H-JR2J-9G78

Affected Products

Hashicorp Terraform Amazon Web Services (Aws) Provider

References · 9

• https://github.com/terraform-providers/terraform-provider-aws/pull/3934 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2018-9057 · Security Note
• https://osv.dev/vulnerability/GHSA-r48h-jr2j-9g78 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2018-9057 · Vendor Advisory
• https://github.com/hashicorp/terraform-provider-aws/pull/3989 · Note
• https://github.com/hashicorp/terraform-provider-aws/pull/3934 · Note
• https://github.com/hashicorp/terraform-provider-aws · Note
• https://github.com/hashicorp/terraform-provider-aws/blob/02b039aa82dd7fc6e4a97a0922cc5dbbab724021/resource_aws_iam_user_login_profile.go#L70-L80 · Note
• https://github.com/hashicorp/terraform-provider-aws/commit/efa8cd45c6484ff70b2a515ea7ff06f2459d4ddf · Note