{"id":"CVE-2019-19316","aliases":["EUVD-2021-1091","GHSA-4rvg-555h-r626","GHSA-h3p9-wrgx-82cm","GO-2022-0839","SUSE-SU-2020:0320-1","openSUSE-SU-2024:11429-1"],"status":"published","title":"Use of a Broken or Risky Cryptographic Algorithm in Terraform","description":"When using the Azure backend with a shared access signature (SAS), Terraform versions prior to 0.12.17 may transmit the token and state snapshot using cleartext HTTP.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.00867,"percentile":0.58994,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-20","CWE-319","CWE-327"],"published":"2019-12-02T20:50:44Z","modified":"2026-10-24T10:50:35Z","fixes":[{"ecosystem":"Go","package":"github.com/hashicorp/terraform","fixed_in":["0.12.17"],"sources":["ghsa","osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP1","package":"terraform","fixed_in":["0.12.19-3.6.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"terraform","fixed_in":["0.14.10-1.12"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Go","package":"github.com/hashicorp/terraform","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.12.17"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/hashicorp/terraform","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.12.17"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/hashicorp/terraform","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.12.17"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP1","package":"terraform","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.12.19-3.6.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"terraform","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.14.10-1.12"}]}]}],"products":[{"vendor":"hashicorp","product":"terraform"}],"references":[{"url":"https://github.com/hashicorp/terraform/security/advisories/GHSA-4rvg-555h-r626","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-19316","tags":["advisory"]},{"url":"https://github.com/hashicorp/terraform/issues/23493","tags":["web","report"]},{"url":"https://github.com/hashicorp/terraform/commit/6db3cf8e5b4cfb2a3cd1d99a813b50b2d5d363bb","tags":["web","fix"]},{"url":"https://pkg.go.dev/vuln/GO-2022-0839","tags":["web"]},{"url":"https://github.com/advisories/GHSA-h3p9-wrgx-82cm","tags":["advisory"]},{"url":"https://github.com/hashicorp/terraform","tags":["package"]},{"url":"https://www.suse.com/support/update/announcement/2020/suse-su-20200320-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1158440","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2019-19316","tags":["web"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2019-19316","description":"When using the Azure backend with a shared access signature (SAS), Terraform versions prior to 0.12.17 may transmit the token and state snapshot using cleartext HTTP.","status":"published","published":"2019-12-02T20:50:44Z","modified":"2024-08-05T02:16:46.943Z","updated_at":"2026-11-02T14:20:20.74896Z"}],"euvd":[{"id":"EUVD-2021-1091","description":"When using the Azure backend with a shared access signature (SAS), Terraform versions prior to 0.12.17 may transmit the token and state snapshot using cleartext HTTP.","status":"published","published":"2019-12-02T20:50:44Z","modified":"2024-08-05T02:16:46Z","updated_at":"2026-11-03T02:40:25.841101Z"}],"ghsa":[{"id":"GHSA-h3p9-wrgx-82cm","title":"Use of a Broken or Risky Cryptographic Algorithm in Terraform","description":"When using the Azure backend with a shared access signature (SAS), Terraform versions prior to 0.12.17 may transmit the token and state snapshot using cleartext HTTP.\n\n### Specific Go Packages Affected\ngithub.com/hashicorp/terraform/backend/remote-state/azure","status":"published","published":"2021-05-18T18:18:50Z","modified":"2024-09-06T21:46:02Z","cvss":[{"version":"4.0","score":8.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","level":"high"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-20","CWE-327"],"updated_at":"2026-11-02T14:38:01.080229Z"}],"nvd":[{"id":"CVE-2019-19316","description":"When using the Azure backend with a shared access signature (SAS), Terraform versions prior to 0.12.17 may transmit the token and state snapshot using cleartext HTTP.","status":"published","published":"2019-12-02T21:15:16.81Z","modified":"2026-06-17T02:26:29.53Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"primary"},{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:P/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-319"],"updated_at":"2026-11-02T14:05:38.993437Z"}],"osv":[{"id":"CVE-2019-19316","description":"When using the Azure backend with a shared access signature (SAS), Terraform versions prior to 0.12.17 may transmit the token and state snapshot using cleartext HTTP.","status":"published","published":"2019-12-02T21:15:16.81Z","modified":"2026-10-24T10:50:35.339706909Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:44:12.010761Z"},{"id":"GHSA-h3p9-wrgx-82cm","title":"Use of a Broken or Risky Cryptographic Algorithm in Terraform","description":"When using the Azure backend with a shared access signature (SAS), Terraform versions prior to 0.12.17 may transmit the token and state snapshot using cleartext HTTP.\n\n### Specific Go Packages Affected\ngithub.com/hashicorp/terraform/backend/remote-state/azure","status":"published","published":"2021-05-18T18:18:50Z","modified":"2026-09-10T03:49:14.75755309Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"},{"version":"4.0","score":8.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-20","CWE-327"],"updated_at":"2026-11-02T15:46:48.546324Z"},{"id":"GO-2022-0839","title":"Use of a Broken or Risky Cryptographic Algorithm in Terraform in github.com/hashicorp/terraform","description":"Use of a Broken or Risky Cryptographic Algorithm in Terraform in github.com/hashicorp/terraform","status":"published","published":"2024-08-21T15:29:04Z","modified":"2026-02-04T04:01:35.113373Z","updated_at":"2026-11-02T15:47:00.918515Z"},{"id":"openSUSE-SU-2024:11429-1","title":"terraform-0.14.10-1.12 on GA media","description":"These are all security issues fixed in the terraform-0.14.10-1.12 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T04:02:40.541577Z","updated_at":"2026-11-02T16:58:35.195147Z"},{"id":"SUSE-SU-2020:0320-1","title":"Security update for terraform","description":"This update for terraform to version 0.12.19 fixes the following issues:\n\n- CVE-2019-19316: Fixed an information leak where SAS token could be transfered in cleartext (bsc#1158440).\n","status":"published","published":"2020-02-04T15:38:50Z","modified":"2026-02-04T03:43:11.400779Z","updated_at":"2026-11-02T15:53:47.06185Z"}]}}