OpenTofu

1.12.2

SECURITY ADVISORIES:

• Previous releases in the v1.12 series could be affected by several vulnerabilities:

  • If for state encryption, OpenBao key provider is used with wrapping algorithms, it could generate panics or hangs on compromised systems where the JWE is specifically crafted.

  This is fixed now by (#4177)

• Previous releases in the v1.12 series could be affected by several vulnerabilities:

  • When using SSH connections through OpenTofu, the errors that were returned from attempting a connection could include unescaped input bytes.
  • If using an attacker-controlled server to run tofu against, it might end up in high CPU consumption.

  These are now fixed by (#4247)

BUG FIXES:

• Properly handle EDEADLK during provider installation. On Unix systems, the kernel may erroneously detect a deadlock between tofu processes using the global plugin cache. (#4166)
• Fix race condition while handling closing signals during tofu login, both when the signal is sent by the user and when the browser fails to successfully connect. (4016)
• Prevent panic when using ephemeral resources during tofu test`. (#4254)

Full Changelog: https://github.com/opentofu/opentofu/compare/v1.12.1...v1.12.2