PT-2020-10282 · Hashicorp · Hashicorp Sentinel

Published 2020-02-14 · Updated 2020-02-25 · CVE-2019-19879

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions HashiCorp Sentinel versions up to 0.10.1

Description The issue concerns the incorrect parsing of negation in certain policy expressions. This was fixed in version 0.10.2.

Recommendations For HashiCorp Sentinel versions up to 0.10.1, update to version 0.10.2 to resolve the issue.

Exploit

Fix

Related Identifiers

CVE-2019-19879

Affected Products

Hashicorp Sentinel

References · 4

• 🔥 https://discuss.hashicorp.com/t/security-bulletin-sentinel-incorrectly-parses-negation-in-certain-policy-expressions/5955 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2019-19879 · Security Note
• https://osv.dev/vulnerability/CVE-2019-19879 · Vendor Advisory
• https://t.me/cvenotify/1034 · Telegram Post