CVE-2023-30618: Insertion of Sensitive Information into Log File (CWE-532)
value: Kitchen-Terraform provides a set of Test Kitchen plugins which enable the use of Test Kitchen to converge a Terraform configuration and verify the resulting infrastructure systems with InSpec controls. Kitchen-Terraform v7.0.0 introduced a regression which caused all Terraform output values, including sensitive values, to be printed at the `info` logging level during the `kitchen converge` action. Prior to v7.0.0, the output values were printed at the `debug` level to avoid writing sensitive values to the terminal by default. An attacker would need access to the local machine in order to gain access to these logs during an operation. Users are advised to upgrade. There are no known workarounds for this vulnerability.
CWE description: Information written to log files can be of a sensitive nature and give valuable guidance to an attacker or expose sensitive user information.
CVSS v3 base score: 3.3
Published: 2023-04-21T20:15Z
Repository: https://github.com/newcontext-oss/kitchen-terraform
Language: Ruby
Files changed: CHANGELOG.md, README.md, lib/kitchen/provisioner/terraform.rb, lib/kitchen/terraform/debug_logger.rb, lib/kitchen/terraform/version.rb, spec/lib/kitchen/terraform/debug_logger_spec.rb, spec/lib/kitchen/terraform/version_spec.rb, spec/support/kitchen/terraform/configurable_examples.rb
Commit date: 2023-04-21 01:36:19 +0000
Commit message: Fix Converge Debug Logging and Prepare 7.0.1 (#522)

* Fix connection debug logging

* Add entry to changelog

* Prepare 7.0.1

---------

Co-authored-by: Aaron Lane <2400330-aaron-lane@users.noreply.gitlab.com>
Diff: diff --git a/CHANGELOG.md b/CHANGELOG.md
index 2a9f56b..9a51596 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -6,14 +6,18 @@ The format is based on [Keep a Changelog](http://keepachangelog.com/en/1.0.0)
 and this project adheres to
 [Semantic Versioning](http://semver.org/spec/v2.0.0.html).
 
 ## [Unreleased][unreleased]
 
+## [7.0.1] - 2023-04-20
+
 ### Fixed
 
 - The doctor check for the `client` attribute uses the PATH to validate
   the value.
+- The debug connection logger for `kitchen converge` is properly
+  initialized.
 
 ## [7.0.0] - 2023-04-09
 
 ### Added
 
@@ -813,11 +817,12 @@ Free-As-In-Beer
 ### Added
 
 - Initial release
 
 [unreleased]:
-  https://github.com/newcontext/kitchen-terraform/compare/v7.0.0...HEAD
+  https://github.com/newcontext/kitchen-terraform/compare/v7.0.1...HEAD
+[7.0.1]: https://github.com/newcontext/kitchen-terraform/compare/v7.0.0...v7.0.1
 [7.0.0]: https://github.com/newcontext/kitchen-terraform/compare/v6.1.0...v7.0.0
 [6.1.0]: https://github.com/newcontext/kitchen-terraform/compare/v6.0.0...v6.1.0
 [6.0.0]: https://github.com/newcontext/kitchen-terraform/compare/v5.8.0...v6.0.0
 [5.8.0]: https://github.com/newcontext/kitchen-terraform/compare/v5.7.2...v5.8.0
 [5.7.2]: https://github.com/newcontext/kitchen-terraform/compare/v5.7.1...v5.7.2
diff --git a/README.md b/README.md
index 3bcb6c3..675c538 100644
--- a/README.md
+++ b/README.md
@@ -109,11 +109,11 @@ example.
 > Installing Kitchen-Terraform with RubyGems
 
 ---
 
 ```sh
-gem install kitchen-terraform --version 7.0.0
+gem install kitchen-terraform --version 7.0.1
 ```
 
 ---
 
 This approach is not recommended as it requires more effort to install
diff --git a/docs/apple-touch-icon-114x114-precomposed.png b/docs/apple-touch-icon-114x114-precomposed.png
index 81d2f47..cc7ae2a 100644
Binary files a/docs/apple-touch-icon-114x114-precomposed.png and b/docs/apple-touch-icon-114x114-precomposed.png differ
diff --git a/docs/apple-touch-icon-120x120-precomposed.png b/docs/apple-touch-icon-120x120-precomposed.png
index 7a97ca4..4311008 100644
Binary files a/docs/apple-touch-icon-120x120-precomposed.png and b/docs/apple-touch-icon-120x120-precomposed.png differ
diff --git a/docs/apple-touch-icon-144x144-precomposed.png b/docs/apple-touch-icon-144x144-precomposed.png
index c1192e3..2b6dced 100644
Binary files a/docs/apple-touch-icon-144x144-precomposed.png and b/docs/apple-touch-icon-144x144-precomposed.png differ
diff --git a/docs/apple-touch-icon-152x152-precomposed.png b/docs/apple-touch-icon-152x152-precomposed.png
index 5c14d66..161a304 100644
Binary files a/docs/apple-touch-icon-152x152-precomposed.png and b/docs/apple-touch-icon-152x152-precomposed.png differ
diff --git a/docs/apple-touch-icon-180x180-precomposed.png b/docs/apple-touch-icon-180x180-precomposed.png
index 6ad0d5d..efd289e 100644
Binary files a/docs/apple-touch-icon-180x180-precomposed.png and b/docs/apple-touch-icon-180x180-precomposed.png differ
diff --git a/docs/apple-touch-icon-57x57-precomposed.png b/docs/apple-touch-icon-57x57-precomposed.png
index e10ab11..dbc1c5b 100644
Binary files a/docs/apple-touch-icon-57x57-precomposed.png and b/docs/apple-touch-icon-57x57-precomposed.png differ
diff --git a/docs/apple-touch-icon-60x60-precomposed.png b/docs/apple-touch-icon-60x60-precomposed.png
index ab814dc..dc0617a 100644
Binary files a/docs/apple-touch-icon-60x60-precomposed.png and b/docs/apple-touch-icon-60x60-precomposed.png differ
diff --git a/docs/apple-touch-icon-72x72-precomposed.png b/docs/apple-touch-icon-72x72-precomposed.png
index ee542d4..c370d24 100644
Binary files a/docs/apple-touch-icon-72x72-precomposed.png and b/docs/apple-touch-icon-72x72-precomposed.png differ
diff --git a/docs/apple-touch-icon-76x76-precomposed.png b/docs/apple-touch-icon-76x76-precomposed.png
index 6ae6685..fe84a3f 100644
Binary files a/docs/apple-touch-icon-76x76-precomposed.png and b/docs/apple-touch-icon-76x76-precomposed.png differ
diff --git a/docs/apple-touch-icon-precomposed.png b/docs/apple-touch-icon-precomposed.png
index e10ab11..dbc1c5b 100644
Binary files a/docs/apple-touch-icon-precomposed.png and b/docs/apple-touch-icon-precomposed.png differ
diff --git a/docs/apple-touch-icon.png b/docs/apple-touch-icon.png
index e10ab11..dbc1c5b 100644
Binary files a/docs/apple-touch-icon.png and b/docs/apple-touch-icon.png differ
diff --git a/docs/favicon-160x160.png b/docs/favicon-160x160.png
index 42fe988..4060227 100644
Binary files a/docs/favicon-160x160.png and b/docs/favicon-160x160.png differ
diff --git a/docs/favicon-16x16.png b/docs/favicon-16x16.png
index c24a789..2c90ea9 100644
Binary files a/docs/favicon-16x16.png and b/docs/favicon-16x16.png differ
diff --git a/docs/favicon-196x196.png b/docs/favicon-196x196.png
index 0ec5c52..ec84874 100644
Binary files a/docs/favicon-196x196.png and b/docs/favicon-196x196.png differ
diff --git a/docs/favicon-32x32.png b/docs/favicon-32x32.png
index b0319a1..d696ba2 100644
Binary files a/docs/favicon-32x32.png and b/docs/favicon-32x32.png differ
diff --git a/docs/favicon-96x96.png b/docs/favicon-96x96.png
index 9aaba11..4809974 100644
Binary files a/docs/favicon-96x96.png and b/docs/favicon-96x96.png differ
diff --git a/docs/favicon.ico b/docs/favicon.ico
index 6033ba9..9709d42 100644
Binary files a/docs/favicon.ico and b/docs/favicon.ico differ
diff --git a/docs/favicon.png b/docs/favicon.png
index c24a789..2c90ea9 100644
Binary files a/docs/favicon.png and b/docs/favicon.png differ
diff --git a/docs/mstile-144x144.png b/docs/mstile-144x144.png
index c1192e3..2b6dced 100644
Binary files a/docs/mstile-144x144.png and b/docs/mstile-144x144.png differ
diff --git a/docs/mstile-150x150.png b/docs/mstile-150x150.png
index 52ebd94..de18e09 100644
Binary files a/docs/mstile-150x150.png and b/docs/mstile-150x150.png differ
diff --git a/docs/mstile-310x150.png b/docs/mstile-310x150.png
index b133e9c..309dd59 100644
Binary files a/docs/mstile-310x150.png and b/docs/mstile-310x150.png differ
diff --git a/docs/mstile-310x310.png b/docs/mstile-310x310.png
index 749b8e0..f7ae6d2 100644
Binary files a/docs/mstile-310x310.png and b/docs/mstile-310x310.png differ
diff --git a/docs/mstile-70x70.png b/docs/mstile-70x70.png
index 3a337eb..2aec7c2 100644
Binary files a/docs/mstile-70x70.png and b/docs/mstile-70x70.png differ
diff --git a/lib/kitchen/provisioner/terraform.rb b/lib/kitchen/provisioner/terraform.rb
index b45bc55..b090423 100644
--- a/lib/kitchen/provisioner/terraform.rb
+++ b/lib/kitchen/provisioner/terraform.rb
@@ -84,11 +84,11 @@ module Kitchen
         transport = driver.transport
 
         ::Kitchen::Terraform::Provisioner::Converge.new(
           config: driver.send(:config),
           connection: transport.connection({}),
-          debug_connection: transport.connection(logger: ::Kitchen::Terraform::DebugLogger.new(logger: logger)),
+          debug_connection: transport.connection(logger: ::Kitchen::Terraform::DebugLogger.new(logger)),
           logger: logger,
           version_requirement: version_requirement,
           workspace_name: workspace_name,
         ).call state: state
       rescue => error
diff --git a/lib/kitchen/terraform/debug_logger.rb b/lib/kitchen/terraform/debug_logger.rb
index b9a7a52..89cb60e 100644
--- a/lib/kitchen/terraform/debug_logger.rb
+++ b/lib/kitchen/terraform/debug_logger.rb
@@ -18,10 +18,23 @@ require "delegate"
 
 module Kitchen
   module Terraform
     # This class delegates to a logger but ensures the debug level is the default level used for logging messages.
     class DebugLogger < ::SimpleDelegator
+      class << self
+        # .new creates a new instance of the class.
+        #
+        # @return [Kitchen::Terraform::DebugLogger]
+        def new(obj)
+          if !obj.kind_of? ::Kitchen::Logger
+            raise ::TypeError, "delegate must be a Kitchen::Logger; recevied #{obj.class}"
+          end
+
+          super
+        end
+      end
+
       # This method overrides the #<< method of the delegate to call #debug.
       #
       # @param message [#to_s] the message to be logged.
       # @return [nil, true] if the given severity is high enough for this particular logger then return
       #   <code>nil</code>; else return <code>true</code>.
diff --git a/lib/kitchen/terraform/version.rb b/lib/kitchen/terraform/version.rb
index b7b421c..beb70c1 100644
--- a/lib/kitchen/terraform/version.rb
+++ b/lib/kitchen/terraform/version.rb
@@ -69,11 +69,11 @@ module Kitchen
 
         private
 
         # @api private
         def value
-          self.value = ::Gem::Version.new "7.0.0" if not @value
+          self.value = ::Gem::Version.new "7.0.1" if not @value
           @value
         end
 
         # @api private
         def value=(version)
diff --git a/spec/lib/kitchen/terraform/debug_logger_spec.rb b/spec/lib/kitchen/terraform/debug_logger_spec.rb
index c4dfaac..7a712d2 100644
--- a/spec/lib/kitchen/terraform/debug_logger_spec.rb
+++ b/spec/lib/kitchen/terraform/debug_logger_spec.rb
@@ -14,27 +14,34 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
 require "kitchen"
 require "kitchen/terraform/debug_logger"
+require "support/kitchen/logger_context"
 
 ::RSpec.describe ::Kitchen::Terraform::DebugLogger do
-  subject do
-    described_class.new logger
+  describe ".new" do
+    specify "raises an error if the delegate is not a Kitchen::Logger" do
+      expect do
+        described_class.new ::Object.new
+      end.to raise_error ::TypeError
+    end
   end
 
-  let :logger do
-    instance_double ::Kitchen::Logger
+  subject do
+    described_class.new ::Kitchen.logger
   end
 
+  include_context "Kitchen::Logger"
+
   shared_examples "#debug" do
     after do
       subject << "message"
     end
 
     specify "forwards the message to #debug of the wrapped logger" do
-      expect(logger).to receive(:debug).with "message"
+      expect(::Kitchen.logger).to receive(:debug).with "message"
     end
   end
 
   describe "#<< " do
     it_behaves_like "#debug"
diff --git a/spec/lib/kitchen/terraform/version_spec.rb b/spec/lib/kitchen/terraform/version_spec.rb
index 1413ef7..4f5929b 100644
--- a/spec/lib/kitchen/terraform/version_spec.rb
+++ b/spec/lib/kitchen/terraform/version_spec.rb
@@ -22,11 +22,11 @@ require "rubygems"
   subject do
     described_class
   end
 
   let :version do
-    ::Gem::Version.new "7.0.0"
+    ::Gem::Version.new "7.0.1"
   end
 
   describe ".assign_plugin_version" do
     let :configurable_class do
       ::Class.new do
diff --git a/spec/support/kitchen/terraform/configurable_examples.rb b/spec/support/kitchen/terraform/configurable_examples.rb
index 28af034..eb4904f 100644
--- a/spec/support/kitchen/terraform/configurable_examples.rb
+++ b/spec/support/kitchen/terraform/configurable_examples.rb
@@ -24,11 +24,11 @@ require "kitchen/driver/terraform"
     end
   end
 
   describe "@plugin_version" do
     it "equals the gem version" do
-      expect(described_class.instance_variable_get(:@plugin_version)).to eq "7.0.0"
+      expect(described_class.instance_variable_get(:@plugin_version)).to eq "7.0.1"
     end
   end
 
   describe "#expand_paths!" do
     context "when #validate_config! has not been called" do

Vulnerable code:   https://github.com/newcontext/kitchen-terraform/compare/v7.0.0...HEAD
gem install kitchen-terraform --version 7.0.0
          debug_connection: transport.connection(logger: ::Kitchen::Terraform::DebugLogger.new(logger: logger)),
          self.value = ::Gem::Version.new "7.0.0" if not @value
  subject do
    described_class.new logger
  let :logger do
    instance_double ::Kitchen::Logger
      expect(logger).to receive(:debug).with "message"
    ::Gem::Version.new "7.0.0"
      expect(described_class.instance_variable_get(:@plugin_version)).to eq "7.0.0"
Fixed code: ## [7.0.1] - 2023-04-20

- The debug connection logger for `kitchen converge` is properly
  initialized.
  https://github.com/newcontext/kitchen-terraform/compare/v7.0.1...HEAD
[7.0.1]: https://github.com/newcontext/kitchen-terraform/compare/v7.0.0...v7.0.1
gem install kitchen-terraform --version 7.0.1
          debug_connection: transport.connection(logger: ::Kitchen::Terraform::DebugLogger.new(logger)),
      class << self
        # .new creates a new instance of the class.
        #
        # @return [Kitchen::Terraform::DebugLogger]
        def new(obj)
          if !obj.kind_of? ::Kitchen::Logger
            raise ::TypeError, "delegate must be a Kitchen::Logger; recevied #{obj.class}"
          end

          super
        end
      end

          self.value = ::Gem::Version.new "7.0.1" if not @value
require "support/kitchen/logger_context"
  describe ".new" do
    specify "raises an error if the delegate is not a Kitchen::Logger" do
      expect do
        described_class.new ::Object.new
      end.to raise_error ::TypeError
    end
  subject do
    described_class.new ::Kitchen.logger
  include_context "Kitchen::Logger"

      expect(::Kitchen.logger).to receive(:debug).with "message"
    ::Gem::Version.new "7.0.1"
      expect(described_class.instance_variable_get(:@plugin_version)).to eq "7.0.1"