CVE-2019-19316: Cleartext Transmission of Sensitive Information

May 18, 2021 (updated September 29, 2023)

When using the Azure backend with a shared access signature (SAS), Terraform versions prior to 0.12.17 may transmit the token and state snapshot using cleartext HTTP.

References

github.com/advisories/GHSA-h3p9-wrgx-82cm
github.com/hashicorp/terraform/commit/6db3cf8e5b4cfb2a3cd1d99a813b50b2d5d363bb
github.com/hashicorp/terraform/issues/23493
github.com/hashicorp/terraform/security/advisories/GHSA-4rvg-555h-r626
nvd.nist.gov/vuln/detail/CVE-2019-19316

Code Behaviors & Features

Detect and mitigate CVE-2019-19316 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →