CVE-2019-19316 Use of a Broken or Risky Cryptographic Algorithm in Terraform

High 7.5 Published 2 Dec 2019 Updated 5 Aug 2024

Attackers can intercept Terraform state and SAS tokens transmitted over cleartext HTTP when using the Azure backend.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2019-19316?

CVE-2019-19316 is a high-severity vulnerability in n/a, published on 2 Dec 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

When using the Azure backend with a shared access signature (SAS), Terraform versions prior to 0.12.17 may transmit the token and state snapshot using cleartext HTTP.

Weakness: CWE-319

Which versions are affected by CVE-2019-19316?

3 open source packages ship an affected version, including github.com/hashicorp/terraform. It affects 1 product.

Package	Affected	Fixed in
`github.com/hashicorp/terraform` Go	All versions	`0.12.17`
`github.com/hashicorp/terraform` Go	All versions	`0.12.17`
`github.com/hashicorp/terraform` Go	All versions	`0.12.17`

Linux distribution packages (2)

`terraform` SUSE:Linux Enterprise Module for Public Cloud 15 SP1	All versions	`0.12.19-3.6.1`
`terraform` openSUSE:Tumbleweed	All versions	`0.14.10-1.12`

Products include Hashicorp Terraform.

How do I fix CVE-2019-19316?

Upgrade github.com/hashicorp/terraform to 0.12.17 or later.

Is CVE-2019-19316 being exploited?

There is no known exploitation of CVE-2019-19316 in the wild and no public exploit code.

Sources

Also known as GHSA-4rvg-555h-r626, GHSA-h3p9-wrgx-82cm, GO-2022-0839, SUSE-SU-2020:0320-1, openSUSE-SU-2024:11429-1.