Skip to content
Release Radar

OpenTofu

Infrastructure as Code

Open-source infrastructure as code, Terraform-compatible

opentofu/opentofuWebsiteDocumentation
v1.12.6same day as v1.11.14
View on GitHub

Release history

v1.12.6

CompareGitHub

SECURITY ADVISORIES:

  • When interacting with OCI Distribution registries for module or provider package installation, earlier versions of OpenTofu could incorrectly resend credentials intended for the original origin to the target of an HTTP redirect. (#4422)
  • When interacting with an attacker-controlled remote state backend or provider/module registry, tofu init in earlier versions of OpenTofu could potentially cause high CPU usage and/or high memory usage resolving crafted relative URLs in the API responses. (#4472)

Full Changelog: https://github.com/opentofu/opentofu/compare/v1.12.5...v1.12.6

SECURITY ADVISORIES:

  • When interacting with OCI Distribution registries for module or provider package installation, previous versions of OpenTofu could incorrectly resend credentials intended for the original origin to the target of an HTTP redirect. (#4423)
  • When interacting with an attacker-controlled remote state backend or provider/module registry, tofu init in earlier versions of OpenTofu could potentially cause high CPU usage and/or high memory usage resolving crafted relative URLs in the API responses. (#4473)

[!NOTE] This is the final patch release planned for the OpenTofu v1.11 series. We recommend upgrading to a newer release series as soon as possible.

Full Changelog: https://github.com/opentofu/opentofu/compare/v1.11.13...v1.11.14

SECURITY ADVISORIES:

  • Previous releases in the v1.12 series could be affected by several vulnerabilities:

    • The Encrypted Client Hello implementation (which is used by OpenTofu through the go stdlib) would leak the pre-shared key identities during the handshake, allowing a passive network observer who can collect handshakes to de-anonymize the hostname of the server, even when ECH was being used.

    This is fixed now by (#4363)

BUG FIXES:

  • Fixed bug where implicit moves and provider address changes would incorrectly cause providers.MovedResourceState to be used in place of providers.UpgradeResourceState (#4375)

Full Changelog: https://github.com/opentofu/opentofu/compare/v1.12.4...v1.12.5

SECURITY ADVISORIES:

  • Previous releases in the v1.11 series could be affected by several vulnerabilities:

    • The Encrypted Client Hello implementation (which is used by OpenTofu through the go stdlib) would leak the pre-shared key identities during the handshake, allowing a passive network observer who can collect handshakes to de-anonymize the hostname of the server, even when ECH was being used.

    This is fixed now by (#4363)

BUG FIXES:

  • Fixed bug where implicit moves and provider address changes would incorrectly cause providers.MovedResourceState to be used in place of providers.UpgradeResourceState (#4375)

Full Changelog: https://github.com/opentofu/opentofu/compare/v1.11.12...v1.11.13

BUG FIXES:

Full Changelog: https://github.com/opentofu/opentofu/compare/v1.12.3...v1.12.4

BUG FIXES:

  • Properly handle TF_ENCRYPTION with only blank spaces. (#4265)
  • The value resulted from the lifecycle.enabled evaluation now has its deprecation marks processed correctly (#4162)
  • Update documentation to clarify the usage restriction of ephemeral values in lifecycle.enabled. (#4220)
  • tofu console -lock=false now works as intended. (#4291)

SECURITY ADVISORIES:

Full Changelog: https://github.com/opentofu/opentofu/compare/v1.12.2...v1.12.3

1.11.9

SECURITY ADVISORIES:

  • Previous releases in the v1.11 series could be affected by several vulnerabilities:

    • ssh usage through OpenTofu generate hangs or panics.
    • Previously, a revoked 'SignatureKey' belonging to a CA was not correctly checked for revocation. Now, both the 'key' and 'key.SignatureKey' are checked for @revoked.

    This is fixed now by (#4145)

  • If for state encryption, OpenBao key provider is used with wrapping algorithms, it could generate panics or hangs on compromised systems where the JWE is specifically crafted. (#4177)

  • Previous releases in the v1.11 series could be affected by several vulnerabilities:

    • When using SSH connections through OpenTofu, the errors that were returned from attempting a connection could include unescaped input bytes.
    • If using an attacker-controlled server to run tofu against, it might end up in high CPU consumption.

    These are now fixed by (#4248)

BUG FIXES:

  • Fix race condition while handling closing signals during tofu login, both when the signal is sent by the user and when the browser fails to successfully connect. (4016)
  • Prevent panic when using ephemeral resources during tofu test`. (#4254)

Full Changelog: https://github.com/opentofu/opentofu/compare/v1.11.8...v1.11.9

1.12.2

SECURITY ADVISORIES:

  • Previous releases in the v1.12 series could be affected by several vulnerabilities:

    • If for state encryption, OpenBao key provider is used with wrapping algorithms, it could generate panics or hangs on compromised systems where the JWE is specifically crafted.

    This is fixed now by (#4177)

  • Previous releases in the v1.12 series could be affected by several vulnerabilities:

    • When using SSH connections through OpenTofu, the errors that were returned from attempting a connection could include unescaped input bytes.
    • If using an attacker-controlled server to run tofu against, it might end up in high CPU consumption.

    These are now fixed by (#4247)

BUG FIXES:

  • Properly handle EDEADLK during provider installation. On Unix systems, the kernel may erroneously detect a deadlock between tofu processes using the global plugin cache. (#4166)
  • Fix race condition while handling closing signals during tofu login, both when the signal is sent by the user and when the browser fails to successfully connect. (4016)
  • Prevent panic when using ephemeral resources during tofu test`. (#4254)

Full Changelog: https://github.com/opentofu/opentofu/compare/v1.12.1...v1.12.2

SECURITY ADVISORIES:

  • Previous releases in the v1.12 series could be affected by several vulnerabilities:

    • ssh usage through OpenTofu generate hangs or panics.
    • Previously, a revoked 'SignatureKey' belonging to a CA was not correctly checked for revocation. Now, both the 'key' and 'key.SignatureKey' are checked for @revoked.

    This is fixed now by (#4145)

BUG FIXES:

  • Address a bug introduced in v1.12.0 causing excessive memory usage by providers. (#4126)
  • Address a bug introduced in v1.12.0 where replace_triggered_by was validated incorrectly. (#4133
  • The Azure key provider will now accept the tenant_id, subscription_id, environment, and metadata_host variables; a bug previously only allowed these to be set through environment variables. (#4091)

Full Changelog: https://github.com/opentofu/opentofu/blob/v1.12/CHANGELOG.md