Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2018-9057

aws/resource_aws_iam_user_login_profile.go in the HashiCorp Terraform Amazon Web Services (AWS) provider through v1.12.0 has an inappropriate PRNG algorithm and seeding, which makes it easier for remote attackers to obtain access by leveraging an IAM account that was provisioned with a weak password.

Published

2018-03-27T18:29:00.307

Last Modified

2024-11-21T04:14:53.183

Status

Modified

Source

[email protected]

Severity

CVSSv3.0: 9.8 (CRITICAL)

CVSSv2 Vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Access Vector: NETWORK
Access Complexity: LOW
Authentication: NONE
Confidentiality Impact: PARTIAL
Integrity Impact: NONE
Availability Impact: NONE

Exploitability Score

10.0

Impact Score

2.9

Weaknesses

Type: Primary
CWE-332

Affected Vendors & Products

Type	Vendor	Product	Version/Range	Vulnerable?
Application	hashicorp	terraform	≤ 1.12.0	Yes

References

https://github.com/terraform-providers/terraform-provider-aws/pull/3934 Issue Tracking, Patch, Third Party Advisory ([email protected])
https://github.com/terraform-providers/terraform-provider-aws/pull/3934 Issue Tracking, Patch, Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)