Bridgecrew Checkov: Unsafe deserialization of Terraform file… (CVE-2021-3040)

Résumé

Bridgecrew Checkov: Unsafe deserialization of Terraform files allows code execution

Description d'origine

La description telle que publiée par la source (souvent en anglais).

An unsafe deserialization vulnerability in Bridgecrew Checkov by Prisma Cloud allows arbitrary code execution when processing a malicious terraform file. This issue impacts Checkov 2.0 versions earlier than Checkov 2.0.139. Checkov 1.0 versions are not impacted.

Source: OSV.dev (Open Source Vulnerabilities) NVD OSV

Paquets affectés

Bitnami checkov

[{"type":"SEMVER","events":[{"introduced":"2.0.0"},{"fixed":"2.0.139"}]}]

Références

advisory security.paloaltonetworks.com
web nvd.nist.gov