FEDORA-2024-a076d7ae8e — security update for opentofu

obsolete

FEDORA-2024-a076d7ae8e created by mikelo2 a year ago for Fedora 39

Fix for CVE-2024-6257 CVE-2024-6104 CVE-2024-24789

This update has been submitted for testing by mikelo2.

This update's test gating status has been changed to 'ignored'.

This update has been pushed to testing.

This update has been obsoleted by opentofu-1.8.0-1.fc39.

Please log in to add feedback.

Metadata

Type

security

Severity

medium

Karma

Signed

Content Type

RPM

Test Gating

ignored

Autopush Settings

Unstable by Karma

-3

Stable by Karma

Stable by Time

7 days

Thresholds

Minimum Karma

Minimum Testing

7 days

Dates

submitted

a year ago

in testing

a year ago

Builds

BZ#2292714 CVE-2024-24789 opentofu: golang: archive/zip: Incorrect handling of certain ZIP files [fedora-all]

BZ#2294007 CVE-2024-6104 opentofu: go-retryablehttp: url might write sensitive information to log file [fedora-all]

BZ#2294255 CVE-2024-6257 opentofu: hashicorp/go-getter: Arbitrary command execution through local git config file [fedora-all]

opentofu-1.7.3-3.fc39

ignored