CVE-2023-30618
Sensitive Terraform Output Values Printed At Info Logging Level In Kitchen-Terraform
- Published
- Updated
- Reserved
- Assigned by
- GitHub_M
Description
Kitchen-Terraform provides a set of Test Kitchen plugins which enable the use of Test Kitchen to converge a Terraform configuration and verify the resulting infrastructure systems with InSpec controls. Kitchen-Terraform v7.0.0 introduced a regression which caused all Terraform output values, including sensitive values, to be printed at the `info` logging level during the `kitchen converge` action. Prior to v7.0.0, the output values were printed at the `debug` level to avoid writing sensitive values to the terminal by default. An attacker would need access to the local machine in order to gain access to these logs during an operation. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Timeline
ID reserved
By GitHub_M
- 8 days later
· 8 days later
Published
- 22 months later
· 22 months later
Record updated
Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| GitHub_MCNA (assigner) | 3.1 | Low3.2 | CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:L/I:N/A:N |
| NVDNVD · Modified | 3.1 | Low3.3 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N |
- EPSS (exploitation in 30 days)
- 0.21% · top 88% of all CVEs (8 Nov 2026)
- CISA SSVC
- Exploitation: none · Automatable: no · Technical impact: partial
The list uses the assigner's score when there is one, then CISA's, then NVD's: Low 3.2.
Weakness
Affected products
newcontext-oss · kitchen-terraform
- affected >= 7.0.0, < 7.0.1
Affected packages
From reviewed advisories of the GitHub Advisory Database.
- RubyGemskitchen-terraformGHSA-65g2-x53q-cmf6 (opens in a new tab)
References (2)
- https://github.com/newcontext-oss/kitchen-terraform/security/advisories/GHSA-65g2-x53q-cmf6 (opens in a new tab)x_refsource_CONFIRMx_transferred
- https://github.com/newcontext-oss/kitchen-terraform/commit/3d20d60e7a891e2dd747df995a31226fa0b4ac48 (opens in a new tab)x_refsource_MISCx_transferred
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisory GHSA-65g2-x53q-cmf6 (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://cveledger.app/cve/CVE-2023-30618)Record last updated .