Critical severity9.8NVD Advisory· Published Mar 27, 2018· Updated Jun 17, 2026
CVE-2018-9057
CVE-2018-9057
Description
aws/resource_aws_iam_user_login_profile.go in the HashiCorp Terraform Amazon Web Services (AWS) provider through v1.12.0 has an inappropriate PRNG algorithm and seeding, which makes it easier for remote attackers to obtain access by leveraging an IAM account that was provisioned with a weak password.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
github.com/hashicorp/terraform-provider-awsGo | < 1.14.0 | 1.14.0 |
Affected products
3- osv-coords3 versionspkg:apk/chainguard/terraform-provider-awspkg:apk/wolfi/terraform-provider-awspkg:golang/github.com/hashicorp/terraform-provider-aws
< 0+ 2 more
- (no CPE)range: < 0
- (no CPE)range: < 0
- (no CPE)range: < 1.14.0
Patches
Vulnerability mechanics
References
7- github.com/terraform-providers/terraform-provider-aws/pull/3934nvdIssue TrackingPatchThird Party AdvisoryWEB
- github.com/advisories/GHSA-r48h-jr2j-9g78ghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2018-9057ghsaADVISORY
- github.com/hashicorp/terraform-provider-aws/blob/02b039aa82dd7fc6e4a97a0922cc5dbbab724021/resource_aws_iam_user_login_profile.goghsaWEB
- github.com/hashicorp/terraform-provider-aws/commit/efa8cd45c6484ff70b2a515ea7ff06f2459d4ddfghsaWEB
- github.com/hashicorp/terraform-provider-aws/pull/3934ghsaWEB
- github.com/hashicorp/terraform-provider-aws/pull/3989ghsaWEB
News mentions
0No linked articles in our index yet.