Detections
Analytics

SCA: security update for github.com/weaveworks/tf-controller (GHSA-6hvv-j432-23cv)

medium Tenable Self-Hosted Container Security Plugin ID 411478

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - Weave GitOps Terraform Controller (aka Weave TF-controller) is a controller for Flux to reconcile
 Terraform resources in a GitOps way. A vulnerability has been identified in Weave GitOps Terraform
 Controller which could allow an authenticated remote attacker to view sensitive information. This
 vulnerability stems from Weave GitOps Terraform Runners (`tf-runner`), where sensitive data is
 inadvertently printed - potentially revealing sensitive user data in their pod logs. In particular,
 functions `tfexec.ShowPlan`, `tfexec.ShowPlanRaw`, and `tfexec.Output` are implicated when the `tfexec`
 object set its `Stdout` and `Stderr` to be `os.Stdout` and `os.Stderr`. An unauthorized remote attacker
 could exploit this vulnerability by accessing these prints of sensitive information, which may contain
 configurations or tokens that could be used to gain unauthorized control or access to resources managed by
 the Terraform controller. A successful exploit could allow the attacker to utilize this sensitive data,
 potentially leading to unauthorized access or control of the system. This vulnerability has been addressed
 in Weave GitOps Terraform Controller versions `v0.14.4` and `v0.15.0-rc.5`. Users are urged to upgrade to
 one of these versions to mitigate the vulnerability. As a temporary measure until the patch can be
 applied, users can add the environment variable `DISABLE_TF_LOGS` to the tf-runners via the runner pod
 template of the Terraform Custom Resource. This will prevent the logging of sensitive information and
 mitigate the risk of this vulnerability. (CVE-2023-34236)

See Also

https://github.com/advisories/GHSA-6hvv-j432-23cv

Plugin Details

Severity: Medium

ID: 411478

Version: Revision 1.6

Type: Local

Family: SCA Checks

Published: 1/23/2025

Updated: 7/2/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Low

Score: 3

Percentile: 23.51

Vendor

Vendor Severity: High

CVSS v2

Risk Factor: Medium

Base Score: 6.8

Temporal Score: 5.3

Vector: CVSS2#AV:N/AC:L/Au:S/C:C/I:N/A:N

CVSS Score Source: CVE-2023-34236

CVSS v3

Risk Factor: Medium

Base Score: 6.5

Temporal Score: 5.9

Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

Vulnerability Information

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 7/14/2023

Vulnerability Publication Date: 7/14/2023

Reference Information

CVE: CVE-2023-34236