Executive brief
OpenTofu potential leaking of secret variable values when using static evaluation in v1.8 in github.com/opentofu/opentofu
Affected products
- Go github.com/opentofu/opentofu
Junglewise Threat Intelligence
CVE-2024-58375: GO-2024-3182 - OpenTofu potential leaking of secret variable values when using static evaluation in v1.8 in github.com/opentofu/opentofu
CVE-2024-58375 · Severity: low · CVSS 3.1 · Published 2024-10-09
Technologies: github.com/opentofu/opentofu (Go). Vendors: Go.
Related threats
- GO-2026-6262 - OpenTofu has high CPU usage when using K8S remote state backend or when parsing specifically crafted TLS certificates from untrusted or comp
- OpenTofu denial of service in tofu init with malicious .zip archives
- OpenTofu symlink following in provider cache directory
- GO-2026-5558 - OpenTofu: Excessive resource usage in "tofu init" when installing dependencies from attacker-controlled server in github.com/opentofu/opento
- GO-2026-5571 - OpenTofu: Possible arbitrary file read during certain git operations via a maliciously crafted URL in github.com/opentofu/opentofu