GHSA-MJCP-GPGX-GGCG OpenTofu incorrectly validates excluded subdomain constraint in conjunction with TLS certificates containing wildcard SANs

When OpenTofu is acting as a TLS client authenticating a certificate chain provided by a TLS server, an excluded subdomain constraint in a certificate chain does not restrict the usage of wildcard SANs in the leaf certificate. For example a constraint that excludes the subdomain test.example.com...

GO-2025-4101 OpenTofu affected denials of service in "tofu init" with maliciously-crafted module package responses in github.com/opentofu/opentofu

OpenTofu affected denials of service in "tofu init" with maliciously-crafted module package responses in github.com/opentofu/opentofu...

Fedora: Security Advisory (FEDORA-2025-21b93506d5)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[SECURITY] Fedora 41 Update: opentofu-1.10.7-1.fc41

OpenTofu lets you declaratively manage your cloud infrastructure...

[SECURITY] Fedora 42 Update: opentofu-1.10.7-1.fc42

OpenTofu lets you declaratively manage your cloud infrastructure...

[SECURITY] Fedora 43 Update: opentofu-1.10.7-1.fc43

OpenTofu lets you declaratively manage your cloud infrastructure...

Fedora 43 : opentofu (2025-21b93506d5)

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2025-21b93506d5 advisory. Update to 1.10.7 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not tested for this...

Fedora 41 : opentofu (2025-c555ce4089)

The remote Fedora 41 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-c555ce4089 advisory. Update to 1.10.7 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not tested f...

Fedora 42 : opentofu (2025-6ab111452f)

The remote Fedora 42 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-6ab111452f advisory. Update to 1.10.7 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not tested f...

opentofu-1.10.7-1.1 on GA media (moderate)

opentofu-1.10.7-1.1 on GA media Announcement ID: openSUSE-SU-2025:15711-1 Rating: moderate Cross-References: CVE-2025-58183 CVE-2025-58185 CVE-2025-58187 CVSS scores: CVE-2025-58183 SUSE : 3.3 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L CVE-2025-58183 SUSE : 4.8...

OPENSUSE-SU-2025:15711-1 opentofu-1.10.7-1.1 on GA media

These are all security issues fixed in the opentofu-1.10.7-1.1 package on the GA media of openSUSE Tumbleweed...

EUVD-2025-38039

OpenTofu affected denials of service in "tofu init" with maliciously-crafted module package responses...

GHSA-W2JF-268Q-MRVH OpenTofu affected denials of service in "tofu init" with maliciously-crafted module package responses

Impact Unauthenticated denial of service. Summary When installing module packages from attacker-controlled sources, tofu init may use unbounded memory, cause high CPU usage, or crash when encountering maliciously-crafted TLS certificate chains or tar archives. Those who depend on modules or...

CVE-2025-58188 vulnerabilities

Vulnerabilities for packages: cluster-proportional-autoscaler, sbom-convert, sriov-network-device-plugin-fips, custom-pod-autoscaler-fips, terraform-provider-azapi-fips, pushprox-fips, kuberlr, sbom-scorecard, trivy-operator, rancher, blob-csi-fips, cloud-provider-aws, node-problem-detector,...

CVE-2025-58189 vulnerabilities

Vulnerabilities for packages: cluster-proportional-autoscaler, sbom-convert, sriov-network-device-plugin-fips, custom-pod-autoscaler-fips, terraform-provider-azapi-fips, pushprox-fips, kuberlr, sbom-scorecard, trivy-operator, rancher, blob-csi-fips, cloud-provider-aws, node-problem-detector,...

GHSA-9GCR-GP5F-JW27 vulnerabilities

Vulnerabilities for packages: cluster-proportional-autoscaler, sbom-convert, sriov-network-device-plugin-fips, custom-pod-autoscaler-fips, terraform-provider-azapi-fips, pushprox-fips, kuberlr, sbom-scorecard, trivy-operator, rancher, blob-csi-fips, cloud-provider-aws, node-problem-detector,...

GHSA-CXQ7-XW9V-RCV3 vulnerabilities

Vulnerabilities for packages: cluster-proportional-autoscaler, sbom-convert, sriov-network-device-plugin-fips, custom-pod-autoscaler-fips, terraform-provider-azapi-fips, pushprox-fips, kuberlr, sbom-scorecard, trivy-operator, rancher, blob-csi-fips, cloud-provider-aws, node-problem-detector,...

CVE-2025-61724 vulnerabilities

Vulnerabilities for packages: cluster-proportional-autoscaler, sbom-convert, sriov-network-device-plugin-fips, custom-pod-autoscaler-fips, terraform-provider-azapi-fips, pushprox-fips, kuberlr, sbom-scorecard, trivy-operator, rancher, blob-csi-fips, cloud-provider-aws, node-problem-detector,...

Fedora: Security Advisory (FEDORA-2025-121049bbf7)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

GHSA-8PJC-487G-W6P2 vulnerabilities

Vulnerabilities for packages: conftest, steampipe, thanos-operator, harbor-registry, helm-push, kuberlr, rancher-security-scan, polaris, rancher, plugin-barman-cloud, node-problem-detector, gcsfuse, dive, kubernetes-csi-external-health-monitor, tflint, harbor-cli, kubeflow-katib,...