Given a configuration of target, contacts and permissions, calling terminate() will permanently prevent this configuration from being used again because the state becomes State.TERMINATED. All other functions require the configuration to be in the other states (UNKNOWN, PLANNED, or EXECUTED).
In other words, the removal of the restoring option for the configuration through EmergencyBrake is permanent.
Recommended Mitigation Steps
Since EmergencyBrake cannot reinstate permissions after termination, it would be better to have terminate change its state to UNKNOWN. The TERMINATED state can therefore be removed.
alcueca
commented
3 years ago
Handle
hickuphh3
Vulnerability details
Impact
Given a configuration of target, contacts and permissions, calling
terminate()will permanently prevent this configuration from being used again because the state becomesState.TERMINATED. All other functions require the configuration to be in the other states (UNKNOWN, PLANNED, or EXECUTED).In other words, the removal of the restoring option for the configuration through
EmergencyBrakeis permanent.Recommended Mitigation Steps
Since
EmergencyBrakecannot reinstate permissions after termination, it would be better to have terminate change its state to UNKNOWN. The TERMINATED state can therefore be removed.