Skip to content

Sensitive Terraform Output Values Printed At Info Logging Level In Kitchen-Terraform v7.0.0, v7.0.1

Low
aaron-lane published GHSA-65g2-x53q-cmf6 Apr 21, 2023

Package

bundler kitchen-terraform (RubyGems)

Affected versions

7.0.0, 7.0.1

Patched versions

7.0.2

Description

Summary

Kitchen-Terraform v7.0.0 introduced a regression which caused all Terraform output values, including sensitive values, to be printed at the info logging level during the kitchen converge action. Prior to v7.0.0, the output values were printed at the debug level to avoid writing sensitive values to the terminal by default.

Original Report

@brettcurtis:

Hopefully, I'm not doing something stupid here, but I'm seeing sensitive outputs printed in the kitchen output. You can check this action for an example: https://github.com/osinfra-io/terraform-google-project/actions/runs/4700065515/jobs/8334277309#step:5:215

It's not really a sensitive value just used it as an example.

Severity

Low
3.2
/ 10

CVSS base metrics

Attack vector
Local
Attack complexity
Low
Privileges required
Low
User interaction
Required
Scope
Changed
Confidentiality
Low
Integrity
None
Availability
None
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:L/I:N/A:N

CVE ID

CVE-2023-30618

Weaknesses

No CWEs

Credits