CGA-4fvw-86mv-qrv4

Published

Last updated

https://images.chainguard.dev/security/CGA-4fvw-86mv-qrv4

Package

terraform-provider-aws

Latest Update

Not affected

Aliases

Severity

9.8

Critical

CVSS V3

Summary

HashiCorp Terraform Amazon Web Services (AWS) uses an insecure PRNG

Description

aws/resource_aws_iam_user_login_profile.go in the HashiCorp Terraform Amazon Web Services (AWS) provider through v1.12.0 has an inappropriate PRNG algorithm and seeding, which makes it easier for remote attackers to obtain access by leveraging an IAM account that was provisioned with a weak password.

References

Updates

Advisories are based on vulnerability information provided by Grype from Anchore. Learn how Chainguard creates security advisories.

Safe Source for Open Source™

Media Kit Contact Us

Private Policy

CGA-4fvw-86mv-qrv4

Severity

Summary

Description

References

Updates

Product

Why Chainguard

Customers

Company

Resources