Terraform goutils library critical vulnerability CVE-2021-4238

[dyferx]

Terraform Version

1.3.7

Terraform Configuration Files

n/a

Debug Output

n/a

Expected Behavior

Terraform binary file passed vulnerability scans

Actual Behavior

Multiple vulnerability scanners (for example Trivy, Grype) are finding critical vulnerability ( CVE-2021-4238 ) in Masterminds/goutils v1.1.0 library used by latest terraform. This is blocking our build pipelines (we are building docker images with terraform inside)

Steps to Reproduce

1. Scan any docker image with latest terraform inside with Trivy or Grype vulnerability scanners.

Additional Context

This can be easy fixed by updating github.com/Masterminds/goutils library to v1.1.1

References

No response

[mmorejon]

Same error here!

[2tim]

Related: #32188

[crw]

Thanks for the report! Per the devs' initial review, the CVE does not affect Terraform's usage of the library, so it is effectively a false positive. That said, we will endeavor to upgrade the library at the earliest convenience. Thanks for bringing it to our attention.

[alisdair]

This will be fixed in the next 1.3 patch release.

[github-actions]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.
If you have found a problem that seems similar to this, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.