CVE-2023-30618
Sensitive Terraform Output Values Printed At Info Logging Level In Kitchen-Terraform
Impact
### Summary Kitchen-Terraform v7.0.0 introduced a regression which caused all Terraform output values, including sensitive values, to be printed at the `info` logging level during the `kitchen converge` action. Prior to v7.0.0, the output values were printed at the `debug` level to avoid writing sensitive values to the terminal by default. ### Original Report @brettcurtis: > Hopefully, I'm not doing something stupid here, but I'm seeing sensitive outputs printed in the kitchen output. You can check this action for an example: https://github.com/osinfra-io/terraform-google-project/actions/runs/4700065515/jobs/8334277309#step:5:215 > > It's not really a sensitive value just used it as an example.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| rubygems | kitchen-terraform | >= 7.0.0, < 7.0.1 | 7.0.1 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Kitchen-Terraform Project | Kitchen-Terraform | Version 7.0.0 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/newcontext-oss/kitchen-terraform/commit/3d20d60e7a891e2dd747df995a31226fa0b4ac48
- https://github.com/newcontext-oss/kitchen-terraform/security/advisories/GHSA-65g2-x53q-cmf6
- https://github.com/advisories/GHSA-65g2-x53q-cmf6
- https://nvd.nist.gov/vuln/detail/CVE-2023-30618
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/kitchen-terraform/CVE-2023-30618.yml