Bridgecrew Checkov: Unsafe deserialization of Terraform file…(CVE-2021-3040)

概要

Bridgecrew Checkov: Unsafe deserialization of Terraform files allows code execution

原文の説明

取得元が公開している説明をそのまま載せています (多くは英語)。

An unsafe deserialization vulnerability in Bridgecrew Checkov by Prisma Cloud allows arbitrary code execution when processing a malicious terraform file. This issue impacts Checkov 2.0 versions earlier than Checkov 2.0.139. Checkov 1.0 versions are not impacted.

出典: OSV.dev (Open Source Vulnerabilities) NVD OSV

影響パッケージ

Bitnami checkov

[{"type":"SEMVER","events":[{"introduced":"2.0.0"},{"fixed":"2.0.139"}]}]

参照URL

advisory security.paloaltonetworks.com
web nvd.nist.gov