CVE-2023-30618 (published 2023-04-21T20:15Z)

Kitchen-Terraform provides a set of Test Kitchen plugins which enable the use of Test Kitchen to converge a Terraform configuration and verify the resulting infrastructure systems with InSpec controls. Kitchen-Terraform v7.0.0 introduced a regression which caused all Terraform output values, including sensitive values, to be printed at the `info` logging level during the `kitchen converge` action. Prior to v7.0.0, the output values were printed at the `debug` level to avoid writing sensitive values to the terminal by default. An attacker would need access to the local machine in order to gain access to these logs during an operation. Users are advised to upgrade. There are no known workarounds for this vulnerability.

CVSS v3 base score: 3.3, LOW (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N)

Weakness information:
cwe_id: CWE-532
cwe_name: Insertion of Sensitive Information into Log File
description: Information written to log files can be of a sensitive nature and give valuable guidance to an attacker or expose sensitive user information.
extended_description: 
            While logging all information may be helpful during development stages, it is important that logging levels be set appropriately before a product ships so that sensitive user data and system information are not accidentally exposed to potential attackers.
            Different log files may be produced and stored for:
            
               Server log files (e.g. server.log).  This can give information on whatever application left the file. Usually this can give full path names and system information, and sometimes usernames and passwords.
               log files that are used for debugging
            
         
         

Fix information:
repo_url: https://github.com/newcontext-oss/kitchen-terraform
commit_details: repo_url: https://github.com/newcontext-oss/kitchen-terraform
author: Aaron Lane
author_date: 2023-04-20 21:36:19-04:00
msg: Fix Converge Debug Logging and Prepare 7.0.1 (#522)

* Fix connection debug logging

* Add entry to changelog

* Prepare 7.0.1

---------

Co-authored-by: Aaron Lane <2400330-aaron-lane@users.noreply.gitlab.com>
repository: repo_url: https://github.com/newcontext-oss/kitchen-terraform
repo_name: newcontext-oss/kitchen-terraform
description: Test Kitchen plugins for testing Terraform configurations
repo_language: Ruby
owner: newcontext-oss
file_changes: filename: CHANGELOG.md
change_type: ModificationType.MODIFY
diff: @@ -8,10 +8,14 @@ and this project adheres to
 
 ## [Unreleased][unreleased]
 
+## [7.0.1] - 2023-04-20
+
 ### Fixed
 
 - The doctor check for the `client` attribute uses the PATH to validate
   the value.
+- The debug connection logger for `kitchen converge` is properly
+  initialized.
 
 ## [7.0.0] - 2023-04-09
 
@@ -815,7 +819,8 @@ Free-As-In-Beer
 - Initial release
 
 [unreleased]:
-  https://github.com/newcontext/kitchen-terraform/compare/v7.0.0...HEAD
+  https://github.com/newcontext/kitchen-terraform/compare/v7.0.1...HEAD
+[7.0.1]: https://github.com/newcontext/kitchen-terraform/compare/v7.0.0...v7.0.1
 [7.0.0]: https://github.com/newcontext/kitchen-terraform/compare/v6.1.0...v7.0.0
 [6.1.0]: https://github.com/newcontext/kitchen-terraform/compare/v6.0.0...v6.1.0
 [6.0.0]: https://github.com/newcontext/kitchen-terraform/compare/v5.8.0...v6.0.0

programming_language: Markdown
filename: README.md
change_type: ModificationType.MODIFY
diff: @@ -111,7 +111,7 @@ example.
 ---
 
 ```sh
-gem install kitchen-terraform --version 7.0.0
+gem install kitchen-terraform --version 7.0.1
 ```
 
 ---

programming_language: Markdown
filename: terraform.rb
change_type: ModificationType.MODIFY
diff: @@ -86,7 +86,7 @@ module Kitchen
         ::Kitchen::Terraform::Provisioner::Converge.new(
           config: driver.send(:config),
           connection: transport.connection({}),
-          debug_connection: transport.connection(logger: ::Kitchen::Terraform::DebugLogger.new(logger: logger)),
+          debug_connection: transport.connection(logger: ::Kitchen::Terraform::DebugLogger.new(logger)),
           logger: logger,
           version_requirement: version_requirement,
           workspace_name: workspace_name,

programming_language: Ruby
filename: debug_logger.rb
change_type: ModificationType.MODIFY
diff: @@ -20,6 +20,19 @@ module Kitchen
   module Terraform
     # This class delegates to a logger but ensures the debug level is the default level used for logging messages.
     class DebugLogger < ::SimpleDelegator
+      class << self
+        # .new creates a new instance of the class.
+        #
+        # @return [Kitchen::Terraform::DebugLogger]
+        def new(obj)
+          if !obj.kind_of? ::Kitchen::Logger
+            raise ::TypeError, "delegate must be a Kitchen::Logger; recevied #{obj.class}"
+          end
+
+          super
+        end
+      end
+
       # This method overrides the #<< method of the delegate to call #debug.
       #
       # @param message [#to_s] the message to be logged.

programming_language: Ruby
filename: version.rb
change_type: ModificationType.MODIFY
diff: @@ -71,7 +71,7 @@ module Kitchen
 
         # @api private
         def value
-          self.value = ::Gem::Version.new "7.0.0" if not @value
+          self.value = ::Gem::Version.new "7.0.1" if not @value
           @value
         end
 

programming_language: Ruby
filename: debug_logger_spec.rb
change_type: ModificationType.MODIFY
diff: @@ -16,23 +16,30 @@
 
 require "kitchen"
 require "kitchen/terraform/debug_logger"
+require "support/kitchen/logger_context"
 
 ::RSpec.describe ::Kitchen::Terraform::DebugLogger do
-  subject do
-    described_class.new logger
+  describe ".new" do
+    specify "raises an error if the delegate is not a Kitchen::Logger" do
+      expect do
+        described_class.new ::Object.new
+      end.to raise_error ::TypeError
+    end
   end
 
-  let :logger do
-    instance_double ::Kitchen::Logger
+  subject do
+    described_class.new ::Kitchen.logger
   end
 
+  include_context "Kitchen::Logger"
+
   shared_examples "#debug" do
     after do
       subject << "message"
     end
 
     specify "forwards the message to #debug of the wrapped logger" do
-      expect(logger).to receive(:debug).with "message"
+      expect(::Kitchen.logger).to receive(:debug).with "message"
     end
   end
 

programming_language: Ruby
filename: version_spec.rb
change_type: ModificationType.MODIFY
diff: @@ -24,7 +24,7 @@ require "rubygems"
   end
 
   let :version do
-    ::Gem::Version.new "7.0.0"
+    ::Gem::Version.new "7.0.1"
   end
 
   describe ".assign_plugin_version" do

programming_language: Ruby
filename: configurable_examples.rb
change_type: ModificationType.MODIFY
diff: @@ -26,7 +26,7 @@ require "kitchen/driver/terraform"
 
   describe "@plugin_version" do
     it "equals the gem version" do
-      expect(described_class.instance_variable_get(:@plugin_version)).to eq "7.0.0"
+      expect(described_class.instance_variable_get(:@plugin_version)).to eq "7.0.1"
     end
   end
 

programming_language: Ruby