aws/resource_aws_iam_user_login_profile.go in the HashiCorp Terraform Amazon Web Services…
Priority MEDIUM 46CWE-332Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.0 · NVD. Fix status from CNA and GitHub.
Summary
aws/resource_aws_iam_user_login_profile.go in the HashiCorp Terraform Amazon Web Services (AWS) provider through v1.12.0 has an inappropriate PRNG algorithm and seeding, which makes it easier for remote attackers to obtain access by leveraging an IAM account that was provisioned with a weak password.
Why it matters now
EPSS 0.01915 79th percentileScored 2026-11-07
Fix Fixed github.com/hashicorp/terraform-provider-aws (Go): 1.14.0
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
| — | github.com/hashicorp/terraform-provider-aws (Go) | before 1.14.0 | 1.14.0 | Patch available | GHSA-r48h-jr2j-9g78 |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
- github.com/hashicorp/terraform-provider-aws (Go) Vendor— Affected before 1.14.0 Fixed in 1.14.0 Patch available GHSA-r48h-jr2j-9g78
Remediation
- Fix · GHSA-r48h-jr2j-9g78 github.com/hashicorp/terraform-provider-aws (Go) Fixed in 1.14.0 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2018-9057
- 2026-10-03 Alias added: GHSA-r48h-jr2j-9g78
References
Other 5
- https://github.com/hashicorp/terraform-provider-aws/pull/3934
- https://github.com/hashicorp/terraform-provider-aws/pull/3989
- https://github.com/hashicorp/terraform-provider-aws/commit/efa8cd45c6484ff70b2a515ea7ff06f2459d4ddf
- https://github.com/hashicorp/terraform-provider-aws
- https://github.com/hashicorp/terraform-provider-aws/blob/02b039aa82dd7fc6e4a97a0922cc5dbbab724021/resource_aws_iam_user_login_profile.go#L70-L80
More HashiCorp Terraform vulnerabilities
- TI-2021-14637 HashiCorp Terraform Enterprise releases up to v202106-1 did not properly perform… CVSS 3.1HIGH 8.8
- TI-2023-04408 Terraform Allows Arbitrary File Write During Init Operation CVSS 3.1HIGH 7.8
- TI-2019-13932 When using the Azure backend with a shared access signature (SAS), Terraform versions… CVSS 3.1HIGH 7.5
- TI-2025-12279 Terraform Enterprise state versions can be created by users with specific permissions without sufficient write access CVSS 3.1MEDIUM 4.3
Sources
- CVE-2018-9057 · CVE Program
- CVE-2018-9057 · NVD
- FIRST EPSS
- GHSA-r48h-jr2j-9g78 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences