x/vulndb: potential Go vuln in github.com/weaveworks/tf-controller: GHSA-6hvv-j432-23cv

[GoVulnBot]

In GitHub Security Advisory GHSA-6hvv-j432-23cv, there is a vulnerability in the following Go packages or modules:

Unit	Fixed	Vulnerable Ranges
github.com/weaveworks/tf-controller	0.15.0-rc.5	>= 0.15.0-rc.1, < 0.15.0-rc.5

Cross references:
No existing reports found with this module or alias.

See doc/triage.md for instructions on how to triage this report.

modules:
    - module: github.com/weaveworks/tf-controller
      versions:
        - introduced: 0.15.0-rc.1
          fixed: 0.15.0-rc.5
      vulnerable_at: 0.15.0-rc.4
      packages:
        - package: github.com/weaveworks/tf-controller
    - module: github.com/weaveworks/tf-controller
      versions:
        - fixed: 0.14.4
      vulnerable_at: 0.14.3
      packages:
        - package: github.com/weaveworks/tf-controller
summary: Weave GitOps Terraform Controller Information Disclosure Vulnerability
description: |-
    ### Impact

    A vulnerability has been identified in Weave GitOps Terraform Controller which
    could allow an authenticated remote attacker to view sensitive information. This
    vulnerability stems from Weave GitOps Terraform Runners (`tf-runner`), where
    sensitive data is inadvertently printed - potentially revealing sensitive user
    data in their pod logs. In particular, functions `tfexec.ShowPlan`,
    `tfexec.ShowPlanRaw`, and `tfexec.Output` are implicated when the `tfexec`
    object set its `Stdout` and `Stderr` to be `os.Stdout` and `os.Stderr`.

    An unauthorized remote attacker could exploit this vulnerability by accessing
    these prints of sensitive information, which may contain configurations or
    tokens that could be used to gain unauthorized control or access to resources
    managed by the Terraform controller.

    A successful exploit could allow the attacker to utilize this sensitive data,
    potentially leading to unauthorized access or control of the system.

    ### Patches

    This vulnerability has been addressed in Weave GitOps Terraform Controller
    versions `v0.14.4` and `v0.15.0-rc.5`. Users are urged to upgrade to one of
    these versions to mitigate the vulnerability.

    The patches for this vulnerability are found in:
    - this commit: 9708fda28ccd0466cb0a8fd409854ab4d92f7dca
    - this commit: 6323b355bd7f5d2ce85d0244fe0883af3881df4e
    - this commit: 28282bc644054e157c3b9a3d38f1f9551ce09074
    - and this commit: 98a0688036e9dbcf43fa84960d9a1ef3e09a69cf

    ### Workarounds

    As a temporary measure until the patch can be applied, users can add the
    environment variable `DISABLE_TF_LOGS` to the tf-runners via the runner pod
    template of the Terraform Custom Resource. This will prevent the logging of
    sensitive information and mitigate the risk of this vulnerability.

    ### References

    - The first issue: https://github.com/weaveworks/tf-controller/issues/637
    - The second issue: https://github.com/weaveworks/tf-controller/issues/649

    ### For More Information

    If you have any further questions or comments about this advisory:

    Open an issue in the Weave GitOps Terraform Controller repository Email us at
    [security@weave.works](mailto:security@weave.works)
cves:
    - CVE-2023-34236
ghsas:
    - GHSA-6hvv-j432-23cv
references:
    - advisory: https://github.com/weaveworks/tf-controller/security/advisories/GHSA-6hvv-j432-23cv
    - report: https://github.com/weaveworks/tf-controller/issues/637
    - report: https://github.com/weaveworks/tf-controller/issues/649
    - fix: https://github.com/weaveworks/tf-controller/commit/28282bc644054e157c3b9a3d38f1f9551ce09074
    - fix: https://github.com/weaveworks/tf-controller/commit/6323b355bd7f5d2ce85d0244fe0883af3881df4e
    - fix: https://github.com/weaveworks/tf-controller/commit/9708fda28ccd0466cb0a8fd409854ab4d92f7dca
    - fix: https://github.com/weaveworks/tf-controller/commit/98a0688036e9dbcf43fa84960d9a1ef3e09a69cf
    - advisory: https://github.com/advisories/GHSA-6hvv-j432-23cv

[gopherbot]

Change https://go.dev/cl/513195 mentions this issue: data/excluded: batch add 26 excluded reports

[gopherbot]

Change https://go.dev/cl/592761 mentions this issue: data/reports: unexclude 75 reports

[gopherbot]

Change https://go.dev/cl/606788 mentions this issue: data/reports: unexclude 20 reports (8)