GitHub Advisoryadvisory · Go

GHSA-h3p9-wrgx-82cm Use of a Broken or Risky Cryptographic Algorithm in Terraform

HIGH Published 2021-05-18 Modified 2024-09-06 Official page ↗
Aliases
CVE-2019-19316
Ecosystem
Go
Packages
github.com/hashicorp/terraform
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-20, CWE-327
Reviewed
2021-05-13

Affected packages

• Go github.com/hashicorp/terraform: < 0.12.17 → fixed in 0.12.17

Description

When using the Azure backend with a shared access signature (SAS), Terraform versions prior to 0.12.17 may transmit the token and state snapshot using cleartext HTTP. Specific Go Packages Affected github.com/hashicorp/terraform/backend/remote-state/azure

Related

Alias · CVE (1)

  • CVE-2019-19316 When using the Azure backend with a shared access signature (SAS), Terraform versions prior to 0.12.17 may transmit the token and state… vulnerability

Weakness · CWE (2)

  • CWE-20 Improper Input Validation weakness
  • CWE-327 Use of a Broken or Risky Cryptographic Algorithm weakness

References