opentofu

v1.11.13 Security

This release includes 1 security fix for security teams reviewing exposed deployments.

Published 5d Infrastructure as Code

✓ No known CVEs patched

This release patches 1 known CVE

Affected surfaces

crypto_tls

Summary

AI summary

Fixes Encrypted Client Hello pre‑shared key identity leakage vulnerability.

Full changelog

SECURITY ADVISORIES:

Previous releases in the v1.11 series could be affected by several vulnerabilities:
- The Encrypted Client Hello implementation (which is used by OpenTofu through the go stdlib) would leak the pre-shared key identities during the handshake,
  allowing a passive network observer who can collect handshakes to de-anonymize the hostname of the server, even when ECH was being used.
This is fixed now by (#4363)

BUG FIXES:

Fixed bug where implicit moves and provider address changes would incorrectly cause providers.MovedResourceState to be used in place of providers.UpgradeResourceState (#4375)

Full Changelog: https://github.com/opentofu/opentofu/compare/v1.11.12...v1.11.13

CVE‑2024‑XXXXX — Encrypted Client Hello (ECH) implementation leaked pre‑shared key identities, enabling passive de‑anonymization of server hostnames; fixed.

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Track opentofu

Get notified when new releases ship.

About opentofu

OpenTofu lets you declaratively manage your cloud infrastructure.

v1.12.0 Removal of OPENTOFU_USER_AGENT environment variable affects custom User-Agent header behavior.