GHSA-fm9p-q6jx: Terraform unbounded read DoS fix with bounded shallow clone

Summary of Key Vulnerability Information Vulnerability Overview CVE ID: GHSA-fm9p-q6jx-9g3x Vulnerability Type: Unbounded read in the Terraform remote configuration loader, which can lead to a Denial of Service (DoS). Trigger Scenario: When a user creates a Terraform remote module in CompactedRefined via , the loader executes protective logic including a shallow clone (shallow depth 1, 2-minute fetch timeout), 64 MB and file size limits, regular and cached file validation, symbolic link rejection, cache invalidation, and cleanup upon URL changes. Impact Scope Affected Version: The branch of (backport target). Affected Component: The Terraform remote configuration loading logic within . Risk: Malicious or abnormal remote Terraform modules can trigger an unbounded read, causing resource-exhaustion-type DoS. Remediation Backport the fix to (PR #7191, already merged). Details of the fix: - Added bounded shallow clone for remote Terraform modules + size limits + cache invalidation. - Explicit cache invalidation handling for symbolic links, non-regular files, cache paths, and oversized reads. - Added targeted unit tests, including Unix-only FIFO tests, to ensure non-regular files are rejected. Related commit: was also backported. Related Files (Reviewed Changes) POC / Exploit Code The documentation does not contain a standalone POC or exploit code block; the fix is reflected through unit tests (e.g., FIFO tests, cache invalidation tests), with no separate executable PoC code snippet provided.

Goal Reached Thanks to every supporter — we hit 100%!

GHSA-fm9p-q6jx: Terraform unbounded read DoS fix with bounded shallow clone

More from this source