CVE-2018-9057

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

aws/resource_aws_iam_user_login_profile.go in the HashiCorp Terraform Amazon Web Services (AWS) provider through v1.12.0 has an inappropriate PRNG algorithm and seeding, which makes it easier for remote attackers to obtain access by leveraging an IAM account that was provisioned with a weak password.

Metrics

CVSS 3.0 9.8/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-332

Affected software

No affected versions have been published.

Timeline

Published
Mar 27, 2018
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2018

CVE-2018-90585.5In Long Range Zip (aka lrzip) 0.631, there is an infinite loop in the runzip_fd function of runzip.c. Remote attackers could leverage this vCVE-2018-90599.8Stack-based buffer overflow in Easy File Sharing (EFS) Web Server 7.2 allows remote attackers to execute arbitrary code via a malicious logiCVE-2018-90626.8In some Lenovo ThinkPad products, one BIOS region is not properly included in the checks, allowing injection of arbitrary code.CVE-2018-90637.8MapDrv (C:\Program Files\Lenovo\System Update\mapdrv.exe) In Lenovo System Update versions earlier than 5.07.0072 contains a local vulnerabiCVE-2018-90648.8In Lenovo xClarity Administrator versions earlier than 2.1.0, an authenticated LXCA user may abuse a web API debug call to retrieve the credCVE-2018-90657.5In Lenovo xClarity Administrator versions earlier than 2.1.0, an attacker that gains access to the underlying LXCA file system user may be aCVE-2018-90668.8In Lenovo xClarity Administrator versions earlier than 2.1.0, an authenticated LXCA user can, under specific circumstances, inject additionaCVE-2018-90677.5The Lenovo Help Android app versions earlier than 6.1.2.0327 had insufficient access control for some functions which, if exploited, could hCVE-2018-90687.5The IMM2 First Failure Data Capture function collects management module logs and diagnostic information when a hardware error is detected. TCVE-2018-90695.9In some Lenovo IdeaPad consumer notebook models, a race condition in the BIOS flash device locking mechanism is not adequately protected agaCVE-2018-90706.4For the Lenovo Smart Assistant Android app versions earlier than 12.1.82, an attacker with physical access to the smart speaker can, by presCVE-2018-90715.3Lenovo Chassis Management Module (CMM) prior to version 2.0.0 allows unauthenticated users to retrieve information related to the current au