Vulnerability roundup 92: terraform-0.13.0: 1 advisory [9.8]

[ckauhaus]

search, files

• CVE-2018-9057 CVSSv3=9.8 (nixos-unstable)

Scanned versions: nixos-unstable: c59ea8b.

Cc @Chili-Man
Cc @babariviere
Cc @kalbasit
Cc @marsam
Cc @peterhoeg
Cc @zimbatm

[ckauhaus]

See also: #94014, #93260

[arianvp]

Bit of a confusing report on NVD. It's not terraform that's vulnerable but terraform-provider-aws which has a different versioning scheme

[ckauhaus]

To the best of my knowledge, we don't package terraform-provider-aws.

[sarcasticadmin]

@ckauhaus The aws provider is package by nixpkgs:

nixpkgs/pkgs/applications/networking/cluster/terraform-providers/data.nix

Lines 75 to 82 in 241eef1

	aws =
	{
	owner = "terraform-providers";
	repo = "terraform-provider-aws";
	rev = "v2.65.0";
	version = "2.65.0";
	sha256 = "005vs1qd6payicxldc9lr4w6kzr58xw9b930j52g1q7hlddl5mbb";
	};

This issue should still be closed since according to NVD report it looks like its referencing a pretty old version of the aws provider:

aws/resource_aws_iam_user_login_profile.go in the HashiCorp Terraform Amazon Web Services (AWS) provider through v1.12.0

[ckauhaus]

@sarcasticadmin Thank you for the pointer. I did not find the thing somehow.