GHSA-4vgf-2cm4-mp7c
Terraform WinDNS Provider improperly sanitizes input variables in `windns_record`
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Go | github.com/nrkno/terraform-provider-windns | <= 1.0.4 | no fix listed |
Details
As written in the advisory (Markdown source, shown as plain text).
## Impact:
A security issue has been found in `terraform-provider-windns` before version `1.0.5`. The `windns_record` resource did not santize the input variables. This can lead to authenticated command injection in the underlyding powershell command prompt.
## Patches:
[`83ef736 (fix: better input validation)`](https://github.com/nrkno/terraform-provider-windns/commit/c76f69610c1b502f90aaed8c4f102194530b5bce)
## Fixed versions:
- `v1.0.5`
References
External links from the advisory. They lead to third-party sites.