CVE-2025-8959 vulnerabilities

Vulnerabilities for packages: snyk-cli, zarf, kubescape, wolfictl, grype, rancher-fleet, kots, tflint, xeol, conftest, trivy, syft, trivy-operator, steampipe, terragrunt, k9s, opentofu, terraform, zot, tfsec...

GHSA-WJRX-6529-HCJ3 vulnerabilities

Vulnerabilities for packages: snyk-cli, zarf, kubescape, wolfictl, grype, rancher-fleet, kots, tflint, xeol, conftest, trivy, syft, trivy-operator, steampipe, terragrunt, k9s, opentofu, terraform, zot, tfsec...

CVE-2025-8959 vulnerabilities

Vulnerabilities for packages: cloudbeat, conftest, steampipe, trivy-operator-fips, rancher-fleet, snyk-cli, xeol, trivy-fips, trivy-operator, kots, tfsec, grype-fips, kubescape, tflint, terraform-fips, wolfictl, k9s-fips, syft, grype, terragrunt, opentofu, rancher-fleet-fips, opentofu-fips,...

GHSA-WJRX-6529-HCJ3 vulnerabilities

Vulnerabilities for packages: cloudbeat, conftest, steampipe, trivy-operator-fips, rancher-fleet, snyk-cli, xeol, trivy-fips, trivy-operator, kots, tfsec, grype-fips, kubescape, tflint, terraform-fips, wolfictl, k9s-fips, syft, grype, terragrunt, opentofu, rancher-fleet-fips, opentofu-fips,...

Fedora 43 : opentofu (2025-121049bbf7)

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-121049bbf7 advisory. Automatic update for opentofu-1.9.1-1.fc43. Changelog Wed May 14 2025 Mikel Olasagasti Uranga - 1.9.1-1 - Update to 1.9.1 - Closes rhbz2362077...

GHSA-J5PM-7495-QMR3 vulnerabilities

Vulnerabilities for packages: cluster-proportional-autoscaler, nri-nagios, sbom-convert, mcp-grafana-fips, custom-pod-autoscaler-fips, terraform-provider-azapi-fips, steampipe, kube-vip-fips, spire-server-fips, sbom-scorecard, trivy-operator, spire-server, blob-csi-fips, opentelemetry-collector,...

opentofu-1.9.1-1.1 on GA media (moderate)

opentofu-1.9.1-1.1 on GA media Announcement ID: openSUSE-SU-2025:15030-1 Rating: moderate Cross-References: CVE-2024-45336 CVE-2024-45341 CVE-2025-22866 CVSS scores: CVE-2024-45336 SUSE : 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N CVE-2024-45341 SUSE : 4.2...

OPENSUSE-SU-2025:15030-1 opentofu-1.9.1-1.1 on GA media

These are all security issues fixed in the opentofu-1.9.1-1.1 package on the GA media of openSUSE Tumbleweed...

GHSA-WPFP-CM49-9M9Q vulnerabilities

Vulnerabilities for packages: vault, terraform, opentofu, opentofu-fips...

CVE-2025-0377 vulnerabilities

Vulnerabilities for packages: vault, terraform, opentofu, opentofu-fips...

opentofu-1.8.6-1.1 on GA media (moderate)

opentofu-1.8.6-1.1 on GA media Announcement ID: openSUSE-SU-2024:14520-1 Rating: moderate Cross-References: CVE-2024-34156 CVSS scores: CVE-2024-34156 SUSE : 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H Affected Products: openSUSE Tumbleweed An update that solves one vulnerability can now be...

OPENSUSE-SU-2024:14520-1 opentofu-1.8.6-1.1 on GA media

These are all security issues fixed in the opentofu-1.8.6-1.1 package on the GA media of openSUSE Tumbleweed...

Fedora 41 : opentofu (2024-8669c2a944)

The remote Fedora 41 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2024-8669c2a944 advisory. Automatic update for opentofu-1.7.3-3.fc41. Changelog Sat Jul 27 2024 Mikel Olasagasti Uranga - 1.7.3-3 - Fix for CVE-2024-6257 CVE-2024-6104...

Information Exposure

github.com/opentofu/opentofu is vulnerable to Information Exposure. The vulnerability is due to the static evaluation of module sources, versions and backend configurations. An attacker can expose sensitive variables and locals...

GO-2024-3182 OpenTofu potential leaking of secret variable values when using static evaluation in v1.8 in github.com/opentofu/opentofu

OpenTofu potential leaking of secret variable values when using static evaluation in v1.8 in github.com/opentofu/opentofu...

OpenTofu potential leaking of secret variable values when using static evaluation in v1.8

Impact Users who have opted into static evaluation of module sources, versions, and backend configurations may be at risk of exposing sensitive variables and locals. This is a workflow that should not be possible and explicitly show errors. Workarounds Check that you are not using sensitive...

GHSA-WPR2-J6GR-PJW9 OpenTofu potential leaking of secret variable values when using static evaluation in v1.8

Impact Users who have opted into static evaluation of module sources, versions, and backend configurations may be at risk of exposing sensitive variables and locals. This is a workflow that should not be possible and explicitly show errors. Workarounds Check that you are not using sensitive...

[SECURITY] Fedora 40 Update: opentofu-1.8.0-1.fc40

OpenTofu lets you declaratively manage your cloud infrastructure...

[SECURITY] Fedora 39 Update: opentofu-1.8.0-1.fc39

OpenTofu lets you declaratively manage your cloud infrastructure...

Fedora 39 : opentofu (2024-35147eb6ad)

The remote Fedora 39 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2024-35147eb6ad advisory. Update to 1.8.0 ---- Fix for CVE-2024-6257 CVE-2024-6104 CVE-2024-24789 Tenable has extracted the preceding description block directly from the Fedo...