VULNERABILITY INTELLIGENCE

CVE-2018-9057

CVSS score9.8 CRITICAL
EPSS probability1.92%
CISA KEVNot currently listed
Published2018-03-27
Last modified2026-06-17
CVSS vectorCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Description

aws/resource_aws_iam_user_login_profile.go in the HashiCorp Terraform Amazon Web Services (AWS) provider through v1.12.0 has an inappropriate PRNG algorithm and seeding, which makes it easier for remote attackers to obtain access by leveraging an IAM account that was provisioned with a weak password.

Weakness classification

  • CWE-332: Insufficient Entropy in PRNG

Primary references