PT-2019-15807 · Hashicorp+1 · Terraform+1
Phekmat
·
Publicado
2019-12-02
·
Atualizado
2024-08-21
·
CVE-2019-19316
CVSS v4.0
8.2
Alta
| Vetor | AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N |
Name of the Vulnerable Software and Affected Versions
Terraform versions prior to 0.12.17
Description
The issue concerns the transmission of sensitive data in cleartext HTTP when using the Azure backend with a shared access signature (SAS) in Terraform. This affects the
github.com/hashicorp/terraform/backend/remote-state/azure package. The problem involves the use of a broken or risky cryptographic algorithm.Recommendations
For Terraform versions prior to 0.12.17, update to version 0.12.17 or later to resolve the issue.
As a temporary workaround, consider disabling the use of cleartext HTTP for transmitting the token and state snapshot until a patch is available.
Restrict access to the Azure backend with a shared access signature (SAS) to minimize the risk of exploitation.
Correção
Cleartext Transmission of Sensitive Information
RCE
Use of a Broken Cryptographic Algorithm
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Suse
Terraform