Alerts This Week
Warning Icon 1 727
Alerts This Week
Warning Icon 1 727

Fedora 40: FEDORA-2024-c83208238d moderate: opentofu Attack Risk Mitigated

fedora
Calendar Grey August 8, 2024
Dist Fedora Esm H88
The recent release of opentofu 1.8.0 addresses significant security vulnerabilities associated with multiple CVEs. Discover more information today!
Update to 1.8.0 Fix for CVE-2024-6257 CVE-2024-6104 CVE-2024-24789

Summary

OpenTofu lets you declaratively manage your cloud infrastructure.

Update Information:

Update to 1.8.0 Fix for CVE-2024-6257 CVE-2024-6104 CVE-2024-24789

Topics%20covered

Topics Covered

security advisory update Fedora arbitrary command execution risk opentofu

Change Log

* Mon Jul 29 2024 Mikel Olasagasti Uranga - 1.8.0-1 - Update to 1.8.0 - Closes rhbz#2300353 * Sat Jul 27 2024 Mikel Olasagasti Uranga - 1.7.3-3 - Fix for CVE-2024-6257 CVE-2024-6104 CVE-2024-24789 - Closes rhbz#2294255 rhbz#2294007 rhbz#2292714 * Thu Jul 18 2024 Fedora Release Engineering - 1.7.3-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild

References


[ 1 ] Bug #2292714 - CVE-2024-24789 opentofu: golang: archive/zip: Incorrect handling of certain ZIP files [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=2292714 [ 2 ] Bug #2294007 - CVE-2024-6104 opentofu: go-retryablehttp: url might write sensitive information to log file [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=2294007 [ 3 ] Bug #2294255 - CVE-2024-6257 opentofu: hashicorp/go-getter: Arbitrary command execution through local git config file [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=2294255

Update Instructions

This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2024-c83208238d' at the command line. For more information, refer to the dnf documentation available at http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label

Name: opentofu
Product: Fedora 40
Version: 1.8.0
Release: 1.fc40
URL: https://github.com/opentofu/opentofu
Summary: OpenTofu lets you declaratively manage your cloud infrastructure

Topics%20covered

Topics Covered

security advisory update Fedora arbitrary command execution risk opentofu

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Your message here