CVE-2023-30618:
Sensitive Terraform Output Values Printed At Info Logging Level In Kitchen-Terraform
3.2
CVSS ScoreBasic Information
CVE ID
GHSA ID
EPSS Score
-
CWE
Published
4/24/2023
Updated
11/6/2023
KEV Status
No
Technology
Ruby
RubyTechnical Details
CVSS Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:L/I:N/A:N
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| kitchen-terraform | rubygems | >= 7.0.0, < 7.0.1 | 7.0.1 |
Vulnerability Intelligence
Miggo AI
Miggo AIRoot Cause Analysis
The vulnerability stemmed from two key changes: 1) In terraform.rb, debug_connection was initialized with DebugLogger.new(logger: logger) which incorrectly passed a keyword argument, leading to improper logger configuration. 2) DebugLogger's constructor lacked type validation, allowing non-debug loggers. The fix corrected both by using positional arguments (DebugLogger.new(logger)) and adding type checks. These functions directly controlled the logging level configuration of sensitive outputs during 'kitchen converge'.