Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[GHSA-fhmj-jv7w-vvg2] Terraform Enterprise since v202207-1 did not properly... #4194

Open
wants to merge 1 commit into
base: anonymous4ACL24/advisory-improvement-4194
Choose a base branch
from
Open

[GHSA-fhmj-jv7w-vvg2] Terraform Enterprise since v202207-1 did not properly... #4194

wants to merge 1 commit into from

Conversation

anonymous4ACL24
Copy link

Updates

  • Affected products
  • Severity
  • Summary

Comments
In reference https://discuss.hashicorp.com/t/hcsec-2023-18-terraform-enterprise-agent-pool-controls-allowed-unauthorized-workspaces-to-target-an-agent-pool/55329, it corresponds to the go developer 'HashiCorp' and affects the package terraform.

@github-actions github-actions bot changed the base branch from main to anonymous4ACL24/advisory-improvement-4194 March 30, 2024 13:33
@darakian
Copy link
Contributor

darakian commented Apr 1, 2024

Hi, I think this advisory may only apply to the enterprise version of terraform based on the description. Do you know of any references indicating that is not the case?

@anonymous4ACL24
Copy link
Author

Hi, I think this advisory may only apply to the enterprise version of terraform based on the description. Do you know of any references indicating that is not the case?

Similar to my response in #4189, I think this vulnerability also applies to the open-source versions of terraform.

@anonymous4ACL24
Copy link
Author

Hi, could you take a look at my preceding response?

@darakian
Copy link
Contributor

Similar to #4189 can you present evidence that the code change applies to the open source version?

@taladrane
Copy link
Collaborator

👋 This pull request has been marked as stale because it has been open with no activity. You can: comment on the issue or remove the stale label to hold stale off for a while, add the Keep label to hold stale off permanently, or do nothing. If you do nothing this pull request will be closed eventually by the stale bot. Please see CONTRIBUTING.md for more policy details.

@taladrane taladrane added the Stale label May 3, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
Stale
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

None yet
3 participants
@anonymous4ACL24 @darakian @taladrane