Go/github.com/opentofu/opentofu: high 7.5
OpenTofu: Possible arbitrary file read during certain git operations via a maliciously crafted URL
Action: Upgrade github.com/opentofu/opentofu to 1.11.10 or later.
go get github.com/opentofu/opentofu@v1.11.10go get github.com/opentofu/opentofu@v1.12.3Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 1.11.10 | - |
| 1.12.0-beta1 | 1.12.3 | - |
Fixed versions
| 1.11.10 | 1.12.3 |
Sources
- osv: GHSA-q7j3-v8qv-22vq
- https://github.com/opentofu/opentofu/security/advisories/GHSA-q7j3-v8qv-22vq
- https://github.com/opentofu/opentofu/pull/4288
- https://github.com/opentofu/opentofu/pull/4292
- https://github.com/opentofu/opentofu/pull/4293
- https://github.com/advisories/GHSA-92mm-2pjq-r785
- https://github.com/hashicorp/go-getter/releases/tag/v1.8.6
- https://github.com/opentofu/opentofu
- https://github.com/opentofu/opentofu/releases/tag/v1.11.10
- https://github.com/opentofu/opentofu/releases/tag/v1.12.3
published · modified · JSON