CVE-2024-58375: OpenTofu before 1.8.3 Secret Variable Leaking via Static Evaluation
OpenTofu versions 1.8.0 through 1.8.2 do not properly restrict sensitive variables and locals when users have opted into static evaluation of module sources, versions, and backend configurations. As a result, values marked as sensitive may be exposed through these configuration elements instead of producing an error. This is fixed in OpenTofu 1.8.3, which adds explicit errors to prevent the use of sensitive values in these contexts.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
OpenTofuto a version that resolves this vulnerability.Fixed in 1.8.3
Event History
Frequently Asked Questions
What is the severity of CVE-2024-58375?
The severity of CVE-2024-58375 is high, with a score of 7.5.
How do I fix CVE-2024-58375?
To fix CVE-2024-58375, update OpenTofu to version 1.8.3 or later.
What does CVE-2024-58375 affect?
CVE-2024-58375 affects OpenTofu versions 1.8.0 through 1.8.2.
What kind of vulnerability is CVE-2024-58375?
CVE-2024-58375 is a secret variable leaking vulnerability caused by improper restriction of sensitive variables.
What are the consequences of CVE-2024-58375?
The consequences of CVE-2024-58375 include potential exposure of sensitive variable values during static evaluation.