CVE-2024-58375

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2024-58375
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-58375.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2024-58375
Aliases
Published
2026-08-16T13:14:03.955Z
Modified
2026-08-17T03:55:42.801423615Z
Severity
  • 8.7 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
OpenTofu before 1.8.3 Secret Variable Leaking via Static Evaluation
Details

OpenTofu versions 1.8.0 through 1.8.2 do not properly restrict sensitive variables and locals when users have opted into static evaluation of module sources, versions, and backend configurations. As a result, values marked as sensitive may be exposed through these configuration elements instead of producing an error. This is fixed in OpenTofu 1.8.3, which adds explicit errors to prevent the use of sensitive values in these contexts.

Database specific 
{
    "cwe_ids": [
        "CWE-497"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/58xxx/CVE-2024-58375.json",
    "cna_assigner": "VulnCheck"
}
References

Affected packages

Git / github.com/opentofu/opentofu

Affected ranges

Type
GIT
Repo
https://github.com/opentofu/opentofu
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
7dfe15a7fa2fde489ad99d5434180b3854cfb289
Database specific
Show details 
{
    "source": "AFFECTED_FIELD",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "1.8.3"
        }
    ]
}

Affected versions

v1.*
v1.6.0-alpha1
v1.6.0-alpha3
v1.6.0-alpha4
v1.6.0-alpha5
v1.6.0-beta1
v1.6.0-beta2
v1.6.0-beta3
v1.6.0-beta4
v1.6.0-beta5
v1.6.0-rc1
v1.7.0-alpha1
v1.7.0-beta1
v1.8.0
v1.8.0-alpha1
v1.8.0-beta1
v1.8.0-beta2
v1.8.0-rc1
v1.8.1
v1.8.2

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-58375.json"