Bridgecrew Checkov: Unsafe deserialization of Terraform file… (CVE-2021-3040)

Summary

Bridgecrew Checkov: Unsafe deserialization of Terraform files allows code execution

Original description

The description as published by the source.

An unsafe deserialization vulnerability in Bridgecrew Checkov by Prisma Cloud allows arbitrary code execution when processing a malicious terraform file. This issue impacts Checkov 2.0 versions earlier than Checkov 2.0.139. Checkov 1.0 versions are not impacted.

Source: OSV.dev (Open Source Vulnerabilities) NVD OSV

Affected packages

Bitnami checkov

[{"type":"SEMVER","events":[{"introduced":"2.0.0"},{"fixed":"2.0.139"}]}]

References

advisory security.paloaltonetworks.com
web nvd.nist.gov