CVE-2023-34236

MITRE NVD CVE.ORG JSON API Print: PDF PDF

Summary

CVECVE-2023-34236
StatePUBLIC
Assigner[email protected]
Source PriorityCVE Program / NVD first with legacy fallback
Published2023-07-14 22:15:00 UTC
Updated2023-07-31 17:07:00 UTC
DescriptionWeave GitOps Terraform Controller (aka Weave TF-controller) is a controller for Flux to reconcile Terraform resources in a GitOps way. A vulnerability has been identified in Weave GitOps Terraform Controller which could allow an authenticated remote attacker to view sensitive information. This vulnerability stems from Weave GitOps Terraform Runners (`tf-runner`), where sensitive data is inadvertently printed - potentially revealing sensitive user data in their pod logs. In particular, functions `tfexec.ShowPlan`, `tfexec.ShowPlanRaw`, and `tfexec.Output` are implicated when the `tfexec` object set its `Stdout` and `Stderr` to be `os.Stdout` and `os.Stderr`. An unauthorized remote attacker could exploit this vulnerability by accessing these prints of sensitive information, which may contain configurations or tokens that could be used to gain unauthorized control or access to resources managed by the Terraform controller. A successful exploit could allow the attacker to utilize this sensitive data, potentially leading to unauthorized access or control of the system. This vulnerability has been addressed in Weave GitOps Terraform Controller versions `v0.14.4` and `v0.15.0-rc.5`. Users are urged to upgrade to one of these versions to mitigate the vulnerability. As a temporary measure until the patch can be applied, users can add the environment variable `DISABLE_TF_LOGS` to the tf-runners via the runner pod template of the Terraform Custom Resource. This will prevent the logging of sensitive information and mitigate the risk of this vulnerability.

Risk And Classification

Problem Types: CWE-200

NVD Known Affected Configurations (CPE 2.3)

TypeVendorProductVersionUpdateEditionLanguage
Application Weave Gitops Terraform Controller All All All All
Application Weave Gitops Terraform Controller 0.15.0 rc1 All All
Application Weave Gitops Terraform Controller 0.15.0 rc2 All All
Application Weave Gitops Terraform Controller 0.15.0 rc3 All All
Application Weave Gitops Terraform Controller 0.15.0 rc4 All All

References

ReferenceSourceLinkTags
Output of plan json to stdout since v0.14.1 · Issue #637 · weaveworks/tf-controller · GitHub MISC github.com
fix logging in tf-runner · weaveworks/tf-controller@6323b35 · GitHub MISC github.com
fix logging in tf-runner · weaveworks/tf-controller@9708fda · GitHub MISC github.com
fix loggin in tf.output · weaveworks/tf-controller@98a0688 · GitHub MISC github.com
fix loggin in tf.output · weaveworks/tf-controller@28282bc · GitHub MISC github.com
Information Disclosure Vulnerability in Weave GitOps Terraform Controller · Advisory · weaveworks/tf-controller · GitHub MISC github.com
Fix logging for tf.output · Issue #649 · weaveworks/tf-controller · GitHub MISC github.com
CVE Program record CVE.ORG www.cve.org canonical
NVD vulnerability detail NVD nvd.nist.gov canonical, analysis

© CVE.report 2026

Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.

CVE, CWE, and OVAL are registred trademarks of The MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. This site includes MITRE data granted under the following license.

Free CVE JSON API cve.report/api

CVE.report and Source URL Uptime Status status.cve.report