9.8crit
CVE-2018-9057
HashiCorp Terraform Amazon Web Services (AWS) uses an insecure PRNG
Also known as GHSA-r48h-jr2j-9g78
Published 8 y ago · modified 58 d ago · JSON
CVSS
9.8
v3.0 · NVD
CISA KEV
No
not known exploited
EPSS
1.9%
percentile 80%
Public exploits
0
none known
Summary
aws/resource_aws_iam_user_login_profile.go in the HashiCorp Terraform Amazon Web Services (AWS) provider through v1.12.0 has an inappropriate PRNG algorithm and seeding, which makes it easier for remote attackers to obtain access by leveraging an IAM account that was provisioned with a weak password.
Exploit prediction (EPSS)
1.92% probability of exploitation in the next 30 days, higher than 80% of all scored CVEs.
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| NVD | 3.0 | 9.8 | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| NVD | 2.0 | 5.0 | AV:N/AC:L/Au:N/C:P/I:N/A:N |
| GitHub | 3.0 | 9.8 | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| go | github.com/hashicorp/terraform-provider-aws | <1.14.0 | 1.14.0 |
Classification
- Weakness
- CWE-332 Insufficient Entropy in PRNG
References
- github.com /terraform-providers/terraform-provider-aws/pull/3934 · x_refsource_MISC, x_transferred
- nvd.nist.gov /vuln/detail/CVE-2018-9057 · advisory
- github.com /hashicorp/terraform-provider-aws/pull/3934 · web
- github.com /hashicorp/terraform-provider-aws/pull/3989 · web
- github.com /hashicorp/terraform-provider-aws/commit/efa8cd45c6484ff70b2a515ea7ff06f2459d4ddf · web
- github.com /hashicorp/terraform-provider-aws · package
- github.com /hashicorp/terraform-provider-aws/blob/02b039aa82dd7fc6e4a97a0922cc5dbbab724021/resource_a · web
Sources
- CVE List: CVE-2018-9057
- GitHub Advisory: GHSA-r48h-jr2j-9g78
- NVD: CVE-2018-9057
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.