CVE-2019-19316
- Source
- https://nvd.nist.gov/vuln/detail/CVE-2019-19316
- Import Source
- https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2019-19316.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/CVE-2019-19316
- Aliases
-
- GHSA-4rvg-555h-r626
- GHSA-h3p9-wrgx-82cm
- GO-2022-0839
- Downstream
- Related
- Published
- 2019-12-02T21:15:16.810Z
- Modified
- 2025-11-14T09:28:19.885273Z
- Severity
-
- 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CVSS Calculator
- Summary
- [none]
- Details
-
When using the Azure backend with a shared access signature (SAS), Terraform versions prior to 0.12.17 may transmit the token and state snapshot using cleartext HTTP.
- References
Affected packages
Git / github.com/hashicorp/terraform
Affected ranges
- Type
- GIT
- Repo
- https://github.com/hashicorp/terraform
- Events
-
Introduced0 Unknown introduced commit / All previous commits are affectedFixed
Affected versions
0.*
0.7.7
Other
list
v0.*
v0.1.0
v0.1.1
v0.10.0
v0.10.0-beta1
v0.10.0-beta2
v0.10.0-rc1
v0.10.1
v0.10.2
v0.10.3
v0.10.4
v0.10.5
v0.10.6
v0.10.7
v0.10.8
v0.11.0
v0.11.0-beta1
v0.11.0-rc1
v0.11.1
v0.11.2
v0.11.3
v0.11.4
v0.11.5
v0.11.6
v0.11.7
v0.11.8
v0.11.9-beta1
v0.12.0
v0.12.0-alpha2
v0.12.0-alpha3
v0.12.0-alpha4
v0.12.0-dev20190520H16
v0.12.0-rc1
v0.12.1
v0.12.10
v0.12.11
v0.12.12
v0.12.13
v0.12.14
v0.12.15
v0.12.16
v0.12.2
v0.12.3
v0.12.4
v0.12.5
v0.12.6
v0.12.7
v0.12.8
v0.12.9
v0.2.0
v0.2.1
v0.2.2
v0.3.0
v0.3.1
v0.3.6
v0.3.7
v0.4.0
v0.4.1
v0.4.2
v0.5.0
v0.5.1
v0.5.3
v0.6.0
v0.6.1
v0.6.10
v0.6.11
v0.6.12
v0.6.13
v0.6.14
v0.6.15
v0.6.16
v0.6.2
v0.6.3
v0.6.4
v0.6.5
v0.6.6
v0.6.7
v0.6.8
v0.6.9
v0.7.0
v0.7.0-rc1
v0.7.0-rc2
v0.7.0-rc3
v0.7.0-rc4
v0.7.1
v0.7.2
v0.7.3
v0.7.4
v0.7.5
v0.7.6
v0.7.7
v0.7.8
v0.7.9
v0.8.0
v0.8.0-beta1
v0.8.0-rc1
v0.8.0-rc2
v0.8.0-rc3
v0.8.1
v0.8.2
v0.8.3
v0.8.4
v0.8.5
v0.9.0
v0.9.0-beta1
v0.9.0-beta2
v0.9.1
v0.9.2
v0.9.3
v0.9.4
v0.9.5
v0.9.6
v0.9.7
v0.9.8