Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
hashicorp/terraform-plugin-sdk
main @ 2a39f72
5
Fixes
0
CVEs
HIGH
Peak severity
Highlights
Information Disclosure: 2 prior fixes. Scrutinize any change in this area.
plugin/discovery: most-fixed (3 issues). Treat as high-risk during review.
3 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Signature Validation Bypass: Flaws in verification logic, such as failing to cross-reference extracted checksums with registry values or failing to validate PGP signatures, allow attackers to distribute tampered or malicious provider binaries to users. Strict verification of both the SHA256SUMS file and the underlying plugin binary is required.
Auth Bypass: Bypassing verification of GPG signatures against official hardcoded keys allows unsigned or untrusted third-party binaries to run within the plugin execution environment.
Information Disclosure: Raw cryptographic material, such as RSA private keys, can leak into error messages during parse, decryption, or base64 decoding failures, leading to compromise of sensitive credentials in console logs and state files.