CVE-2018-9057 HashiCorp Terraform Amazon Web Services (AWS) uses an insecure PRNG
Weak password generation in Terraform AWS provider allows attackers to guess IAM login credentials and take over accounts.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2018-9057?
CVE-2018-9057 is a critical vulnerability in n/a, published on 27 Mar 2018. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
aws/resource_aws_iam_user_login_profile.go in the HashiCorp Terraform Amazon Web Services (AWS) provider through v1.12.0 has an inappropriate PRNG algorithm and seeding, which makes it easier for remote attackers to obtain access by leveraging an IAM account that was provisioned with a weak password.
Weakness: CWE-332
Which versions are affected by CVE-2018-9057?
2 open source packages ship an affected version, including github.com/hashicorp/terraform-provider-aws. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
github.com/hashicorp/terraform-provider-aws Go | All versions | 1.14.0 |
github.com/hashicorp/terraform-provider-aws Go | All versions | 1.14.0 |
Products include Hashicorp Terraform.
How do I fix CVE-2018-9057?
Upgrade github.com/hashicorp/terraform-provider-aws to 1.14.0 or later.
Is CVE-2018-9057 being exploited?
There is no known exploitation of CVE-2018-9057 in the wild and no public exploit code.
Other vulnerabilities in n/a
- CVE-2021-36230 Missing authorization in n/a
- CVE-2019-19316 Use of a Broken or Risky Cryptographic Algorithm in Terraform
- CVE-2023-4782 Terraform Allows Arbitrary File Write During Init Operation
- CVE-2025-13432 Terraform Enterprise state versions can be created by users with specific permissions without sufficient write access
Sources
Also known as GHSA-r48h-jr2j-9g78.