CVE-2023-30618 json
Sensitive Terraform Output Values Printed At Info Logging Level In Kitchen-Terraform
published 3y ago modified 2mo ago also GHSA-65g2-x53q-cmf6 , EUVD-2023-1211
- cvss
- 3.2
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.2%
- EPSS 0.2% chance of exploitation in 30 days, percentile 11%
- public exploits
- 0
- none known
Summary
Kitchen-Terraform provides a set of Test Kitchen plugins which enable the use of Test Kitchen to converge a Terraform configuration and verify the resulting infrastructure systems with InSpec controls. Kitchen-Terraform v7.0.0 introduced a regression which caused all Terraform output values, including sensitive values, to be printed at the `info` logging level during the `kitchen converge` action. Prior to v7.0.0, the output values were printed at the `debug` level to avoid writing sensitive values to the terminal by default. An attacker would need access to the local machine in order to gain access to these logs during an operation. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Patch / fix
Is CVE-2023-30618 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerCISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- last yr.
Exploit prediction
0.21% chance of exploitation in the next 30 days, higher than 11% of all scored CVEs (FIRST EPSS, 2026-11-14).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 3.2 | CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:L/I:N/A:N |
| NVD | 3.1 | 3.3 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N |
| GitHub | 3.1 | 3.2 | CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:L/I:N/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| rubygems | kitchen-terraform | >=7.0.0, <7.0.1 |
7.0.1 |
Affected products
- newcontext-oss kitchen-terraform
Classification
- Weakness
-
- CWE-532 Insertion of Sensitive Information into Log File
References
-
github.com
/newcontext-oss/kitchen-terraform/commit/3d20d60e7a891e2dd747df995a31226fa0b4ac48
web, patch
-
github.com
/newcontext-oss/kitchen-terraform/security/advisories/GHSA-65g2-x53q-cmf6
web, third-party-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2023-30618
advisory
-
github.com
/newcontext-oss/kitchen-terraform
package
-
github.com
/rubysec/ruby-advisory-db/blob/master/gems/kitchen-terraform/CVE-2023-30618.yml
web
Sources
- CVE List CVE-2023-30618
- GitHub Advisory GHSA-65g2-x53q-cmf6
- NVD CVE-2023-30618
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.