CVE-2018-9057

Published: Mar 27, 2018Modified: Jun 17, 2026

9.8

Vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 5.9

Source: NVD

Description

aws/resource_aws_iam_user_login_profile.go in the HashiCorp Terraform Amazon Web Services (AWS) provider through v1.12.0 has an inappropriate PRNG algorithm and seeding, which makes it easier for remote attackers to obtain access by leveraging an IAM account that was provisioned with a weak password.

Affected (1)

Products: Hashicorp: Terraform

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Hashicorp Terraform	Up to 1.12.0

Related CWEs

Insufficient Entropy in PRNG

The lack of entropy available for, or used by, a Pseudo-Random Number Generator (PRNG) can be a stability and security threat.

References (2)

https://github.com/terraform-providers/terraform-provider-aws/pull/3934

Source: cve@mitre.org

Issue TrackingPatchThird Party Advisory

https://github.com/terraform-providers/terraform-provider-aws/pull/3934

Source: af854a3a-2127-422b-91ae-364da2661108

Issue TrackingPatchThird Party Advisory

Timeline

No history available yet.