CVE-2023-30618 (Ruby, published 2023-04-21T20:15Z)
Description: value: Kitchen-Terraform provides a set of Test Kitchen plugins which enable the use of Test Kitchen to converge a Terraform configuration and verify the resulting infrastructure systems with InSpec controls. Kitchen-Terraform v7.0.0 introduced a regression which caused all Terraform output values, including sensitive values, to be printed at the `info` logging level during the `kitchen converge` action. Prior to v7.0.0, the output values were printed at the `debug` level to avoid writing sensitive values to the terminal by default. An attacker would need access to the local machine in order to gain access to these logs during an operation. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Severity: nan (CVSS v3 base score: 3.3)
Weakness: CWE-532 \u2014 Insertion of Sensitive Information into Log File
Information written to log files can be of a sensitive nature and give valuable guidance to an attacker or expose sensitive user information.
Repository: https://github.com/newcontext-oss/kitchen-terraform
Files changed:
CHANGELOG.md
README.md
lib/kitchen/provisioner/terraform.rb
lib/kitchen/terraform/debug_logger.rb
lib/kitchen/terraform/version.rb
spec/lib/kitchen/terraform/debug_logger_spec.rb
spec/lib/kitchen/terraform/version_spec.rb
spec/support/kitchen/terraform/configurable_examples.rb
Commit message: Fix Converge Debug Logging and Prepare 7.0.1 (#522)

* Fix connection debug logging

* Add entry to changelog

* Prepare 7.0.1

---------

Co-authored-by: Aaron Lane <2400330-aaron-lane@users.noreply.gitlab.com>

Vulnerable code:
  https://github.com/newcontext/kitchen-terraform/compare/v7.0.0...HEAD
gem install kitchen-terraform --version 7.0.0
          debug_connection: transport.connection(logger: ::Kitchen::Terraform::DebugLogger.new(logger: logger)),
          self.value = ::Gem::Version.new "7.0.0" if not @value
  subject do
    described_class.new logger
  let :logger do
    instance_double ::Kitchen::Logger
      expect(logger).to receive(:debug).with "message"
    ::Gem::Version.new "7.0.0"
      expect(described_class.instance_variable_get(:@plugin_version)).to eq "7.0.0"

Fixed code:
## [7.0.1] - 2023-04-20

- The debug connection logger for `kitchen converge` is properly
  initialized.
  https://github.com/newcontext/kitchen-terraform/compare/v7.0.1...HEAD
[7.0.1]: https://github.com/newcontext/kitchen-terraform/compare/v7.0.0...v7.0.1
gem install kitchen-terraform --version 7.0.1
          debug_connection: transport.connection(logger: ::Kitchen::Terraform::DebugLogger.new(logger)),
      class << self
        # .new creates a new instance of the class.
        #
        # @return [Kitchen::Terraform::DebugLogger]
        def new(obj)
          if !obj.kind_of? ::Kitchen::Logger
            raise ::TypeError, "delegate must be a Kitchen::Logger; recevied #{obj.class}"
          end

          super
        end
      end

          self.value = ::Gem::Version.new "7.0.1" if not @value
require "support/kitchen/logger_context"
  describe ".new" do
    specify "raises an error if the delegate is not a Kitchen::Logger" do
      expect do
        described_class.new ::Object.new
      end.to raise_error ::TypeError
    end
  subject do
    described_class.new ::Kitchen.logger
  include_context "Kitchen::Logger"

      expect(::Kitchen.logger).to receive(:debug).with "message"
    ::Gem::Version.new "7.0.1"
      expect(described_class.instance_variable_get(:@plugin_version)).to eq "7.0.1"