github.com/hashicorp/terraform (Go) — known CVEs & security advisories

Known CVE vulnerabilities and GitHub Security Advisories affecting the Go package github.com/hashicorp/terraform, with affected version ranges, CVSS severity, EPSS exploit prediction, and CISA KEV status.

CVEs (2)

• CVE-2019-19316 — CVSS 7.5 (high): When using the Azure backend with a shared access signature (SAS), Terraform versions prior to 0.12.17 may transmit the token and state…
• CVE-2023-4782 — CVSS 6.3 (medium): Terraform version 1.0.8 through 1.5.6 allows arbitrary file write during the `init` operation if run on maliciously crafted Terraform…