PT-2019-19275 · Octopus Deploy+1 · Octopus Deploy+1

Mcasperson · Published 2019-02-20 · Updated 2022-07-27 · CVE-2019-8944

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Octopus Deploy versions prior to 2018.10.4 LTS Octopus Deploy versions prior to 2019.1.8

Description An Information Exposure issue in the Terraform deployment step allows remote authenticated users to view sensitive Terraform output variables via log files.

Recommendations For versions prior to 2018.10.4 LTS, update to version 2018.10.4 LTS or later. For versions prior to 2019.1.8, update to version 2019.1.8 or later.

Fix

Insertion into Log File

Weakness Enumeration

CWE-532

Related Identifiers

CVE-2019-8944

Affected Products

Octopus Deploy

Terraform

References · 4

• https://osv.dev/vulnerability/CVE-2019-8944 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-8944 · Security Note
• https://github.com/OctopusDeploy/Issues/issues/5314 · Note
• https://github.com/OctopusDeploy/Issues/issues/5315 · Note