CVE-2018-9057 describes a critical vulnerability in the HashiCorp Terraform AWS provider (through v1.12.0) where an inappropriate pseudo-random number generator (PRNG) and weak seeding were used for generating IAM user login profile passwords. This flaw, rated 9.8 Critical (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), allows remote attackers to easily guess and exploit weak passwords, leading to complete compromise of confidentiality, integrity, and availability of affected IAM accounts. Despite its severity, there is no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage surrounding this CVE.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
<= 1.12.0CPE matchmatch criteria | cpe:2.3:a:hashicorp:terraform:*:*:*:*:*:aws:*:* |
CVSS version used by this source: 3.0
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.3 Bluesky, 0.3 Mastodon, and 2.4 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
HashiCorp Terraform Amazon Web Services (AWS) uses an insecure PRNG
May 14, 2022CVE-2018-9057
Apr 12, 2022aws/resource_aws_iam_user_login_profile.go in the HashiCorp Terraform Amazon Web Services (AWS) provider through v1.12.0 has an inappropriate PRNG algorithm and seeding which makes it easier for remote attackers to obtain access by leveraging an IAM account that was provisioned with a weak password.
Mar 13, 2018