GHSA-W2JF-268Q-MRVH OpenTofu affected denials of service in "tofu init" with maliciously-crafted module package responses

Impact Unauthenticated denial of service. Summary When installing module packages from attacker-controlled sources, tofu init may use unbounded memory, cause high CPU usage, or crash when encountering maliciously-crafted TLS certificate chains or tar archives. Those who depend on modules or...

EUVD-2025-38039

OpenTofu affected denials of service in "tofu init" with maliciously-crafted module package responses...

CVE-2025-58188 vulnerabilities

Vulnerabilities for packages: chartmuseum, wire-go, gatekeeper-fips, distribution-fips, packer, cluster-api-helm-controller, karpenter, kuberlr, stampdalf, azurefile-csi, cilium, aws-sigv4-proxy, terraform-provider-tls-fips, redka, kpt, kube-metrics-adapter, scuttle,...

GHSA-CXQ7-XW9V-RCV3 vulnerabilities

Vulnerabilities for packages: chartmuseum, wire-go, gatekeeper-fips, distribution-fips, packer, cluster-api-helm-controller, karpenter, kuberlr, stampdalf, azurefile-csi, cilium, aws-sigv4-proxy, terraform-provider-tls-fips, redka, kpt, kube-metrics-adapter, scuttle,...

CVE-2025-58189 vulnerabilities

Vulnerabilities for packages: chartmuseum, wire-go, gatekeeper-fips, distribution-fips, packer, cluster-api-helm-controller, karpenter, kuberlr, stampdalf, azurefile-csi, cilium, aws-sigv4-proxy, terraform-provider-tls-fips, redka, kpt, kube-metrics-adapter, scuttle,...

CVE-2025-61724 vulnerabilities

Vulnerabilities for packages: chartmuseum, wire-go, gatekeeper-fips, distribution-fips, packer, cluster-api-helm-controller, karpenter, kuberlr, stampdalf, azurefile-csi, cilium, aws-sigv4-proxy, terraform-provider-tls-fips, redka, kpt, kube-metrics-adapter, scuttle,...

GHSA-9GCR-GP5F-JW27 vulnerabilities

Vulnerabilities for packages: chartmuseum, wire-go, gatekeeper-fips, distribution-fips, packer, cluster-api-helm-controller, karpenter, kuberlr, stampdalf, azurefile-csi, cilium, aws-sigv4-proxy, terraform-provider-tls-fips, redka, kpt, kube-metrics-adapter, scuttle,...

Fedora: Security Advisory (FEDORA-2025-121049bbf7)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

GHSA-8PJC-487G-W6P2 vulnerabilities

Vulnerabilities for packages: chartmuseum, wire-go, kube-logging-operator, helm-set-status, cloud-provider-vsphere, cluster-api-helm-controller, kubernetes-dashboard, gptscript, karpenter, kuberlr, node-problem-detector, nuclei, aws-otel-collector, fulcio, vault-csi-provider, kpt, undock,...

CVE-2025-8959 vulnerabilities

Vulnerabilities for packages: syft, tfsec, steampipe, trivy-operator, grype, tflint, terragrunt, zarf, wolfictl, k9s, kubescape, conftest, zot, terraform, trivy, xeol, snyk-cli, rancher-fleet, kots, opentofu...

GHSA-WJRX-6529-HCJ3 vulnerabilities

Vulnerabilities for packages: syft, tfsec, steampipe, trivy-operator, grype, tflint, terragrunt, zarf, wolfictl, k9s, kubescape, conftest, zot, terraform, trivy, xeol, snyk-cli, rancher-fleet, kots, opentofu...

CVE-2025-8959 vulnerabilities

Vulnerabilities for packages: trivy, k9s-fips, conftest, xeol-fips, cloudbeat-fips, rancher-fleet, trivy-fips, tflint, steampipe, rancher-fleet-fips, wolfictl, chainctl, terragrunt, grype-fips, terraform, trivy-operator-fips, xeol, k9s, terraform-fips, kubescape, syft-fips, grype, zot, snyk-cli,...

GHSA-WJRX-6529-HCJ3 vulnerabilities

Vulnerabilities for packages: trivy, k9s-fips, conftest, xeol-fips, cloudbeat-fips, rancher-fleet, trivy-fips, tflint, steampipe, rancher-fleet-fips, wolfictl, chainctl, terragrunt, grype-fips, terraform, trivy-operator-fips, xeol, k9s, terraform-fips, kubescape, syft-fips, grype, zot, snyk-cli,...

Fedora 43 : opentofu (2025-121049bbf7)

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-121049bbf7 advisory. Automatic update for opentofu-1.9.1-1.fc43. Changelog Wed May 14 2025 Mikel Olasagasti Uranga - 1.9.1-1 - Update to 1.9.1 - Closes rhbz2362077...

GHSA-J5PM-7495-QMR3 vulnerabilities

Vulnerabilities for packages: gatekeeper-fips, kube-logging-operator, logstash, packer, cluster-api-helm-controller, timestamp-authority-fips, fuse-overlayfs-snapshotter, karpenter, trivy-fips, azurefile-csi, cilium, aws-sigv4-proxy, kubernetes-csi-external-provisioner-fips,...

opentofu-1.9.1-1.1 on GA media (moderate)

opentofu-1.9.1-1.1 on GA media Announcement ID: openSUSE-SU-2025:15030-1 Rating: moderate Cross-References: CVE-2024-45336 CVE-2024-45341 CVE-2025-22866 CVSS scores: CVE-2024-45336 SUSE : 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N CVE-2024-45341 SUSE : 4.2...

OPENSUSE-SU-2025:15030-1 opentofu-1.9.1-1.1 on GA media

These are all security issues fixed in the opentofu-1.9.1-1.1 package on the GA media of openSUSE Tumbleweed...

GHSA-WPFP-CM49-9M9Q vulnerabilities

Vulnerabilities for packages: vault, terraform, opentofu-fips, opentofu...

CVE-2025-0377 vulnerabilities

Vulnerabilities for packages: vault, terraform, opentofu-fips, opentofu...

opentofu-1.8.6-1.1 on GA media (moderate)

opentofu-1.8.6-1.1 on GA media Announcement ID: openSUSE-SU-2024:14520-1 Rating: moderate Cross-References: CVE-2024-34156 CVSS scores: CVE-2024-34156 SUSE : 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H Affected Products: openSUSE Tumbleweed An update that solves one vulnerability can now be...