{"id":"CVE-2019-20933","aliases":["DEBIAN-CVE-2019-20933","DLA-2501-1","DSA-4823-1","EUVD-2021-0904","GHSA-2rmp-fw5r-j5qv","GO-2022-0780","SUSE-SU-2020:3624-1","SUSE-SU-2020:3897-1","UBUNTU-CVE-2019-20933","USN-5451-1"],"status":"published","title":"Improper Authentication in InfluxDB","description":"InfluxDB before 1.7.6 has an authentication bypass vulnerability in the authenticate function in services/httpd/handler.go because a JWT token may have an empty SharedSecret (aka shared secret).","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.30921,"percentile":0.9827,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-287"],"published":"2020-11-19T01:50:50Z","modified":"2026-10-20T10:52:40Z","exploits":[{"source":"pocgithub","id":"LorenzoTullini/InfluxDB-Exploit-CVE-2019-20933","title":"LorenzoTullini/InfluxDB-Exploit-CVE-2019-20933","date":"2021-04-28","url":"https://github.com/LorenzoTullini/InfluxDB-Exploit-CVE-2019-20933"},{"source":"pocgithub","id":"Hydragyrum/CVE-2019-20933","title":"Hydragyrum/CVE-2019-20933","date":"2021-07-24","url":"https://github.com/Hydragyrum/CVE-2019-20933"},{"source":"pocgithub","id":"Dungsocool/CVE-2019-20933","title":"Dungsocool/CVE-2019-20933","date":"2026-05-28","url":"https://github.com/Dungsocool/CVE-2019-20933"},{"source":"pocgithub","id":"CyberCTF/vulhub-influxdb-cve-2019-20933","title":"CyberCTF/vulhub-influxdb-cve-2019-20933","date":"2026-10-08","url":"https://github.com/CyberCTF/vulhub-influxdb-cve-2019-20933"},{"source":"nuclei","id":"CVE-2019-20933","title":"InfluxDB \u003c1.7.6 - Authentication Bypass","type":"detection template","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-20933.yaml"}],"fixes":[{"ecosystem":"Go","package":"github.com/influxdata/influxdb","fixed_in":["1.7.6"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:12","package":"influxdb","fixed_in":["1.6.7~rc0-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"influxdb","fixed_in":["1.6.7~rc0-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"influxdb","fixed_in":["1.6.7~rc0-1"],"sources":["osv"]},{"ecosystem":"Debian:9","package":"influxdb","fixed_in":["1.1.1+dfsg1-4+deb9u1"],"sources":["osv"]},{"ecosystem":"Debian:10","package":"influxdb","fixed_in":["1.6.4-1+deb10u1"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"influxdb","fixed_in":["1.1.1+dfsg1-4+deb9u1ubuntu1"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"influxdb","fixed_in":["1.6.4-1+deb10u1build0.20.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"influxdb","fixed_in":["1.6.7~rc0-1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Go","package":"github.com/influxdata/influxdb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.6"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"influxdb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.7~rc0-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"influxdb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.7~rc0-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"influxdb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.7~rc0-1"}]}]},{"source":"osv","ecosystem":"Debian:9","package":"influxdb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.1+dfsg1-4+deb9u1"}]}],"versions":["1.1.1+dfsg1-4"]},{"source":"osv","ecosystem":"Debian:10","package":"influxdb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.4-1+deb10u1"}]}],"versions":["1.6.4-1"]},{"source":"osv","ecosystem":"Go","package":"github.com/influxdata/influxdb","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.7.6"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/influxdata/influxdb","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.7.6"}]}]},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 7","package":"crowbar-openstack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0+git.1604938545.30c10db18-9.77.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 7","package":"grafana","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.7.4-1.20.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 7","package":"influxdb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.4-5.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 7","package":"python-urllib3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16-3.12.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"ardana-cassandra","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0+git.1600802664.7e480a2-3.6.2"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"ardana-mq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0+git.1605174486.a78ddce-3.19.2"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"ardana-osconfig","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0+git.1601621747.a87e5a0-3.22.2"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"ardana-tempest","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0+git.1603378983.fc0bca9-3.19.2"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"grafana","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.7.4-3.20.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"influxdb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.8-4.3.3"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"openstack-cinder","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"13.0.10~dev20-3.28.2"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"openstack-heat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.0.4~dev4-3.19.2"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"openstack-heat-gbp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.0.1~dev2-3.3.4"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"openstack-heat-templates","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.0+git.1605509190.64f020b6-3.9.3"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"openstack-horizon-plugin-gbp-ui","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.0.1~dev3-3.3.4"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"openstack-ironic-python-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.4~dev6-3.19.4"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"openstack-manila","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4.2~dev57-4.30.2"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"openstack-neutron","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"13.0.8~dev135-3.31.2"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"openstack-neutron-gbp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.0.1~dev5-3.19.4"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"openstack-neutron-vpnaas","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"13.0.2~dev6-3.9.2"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"openstack-nova","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.3.1~dev77-3.31.2"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"python-Jinja2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.10.1-3.3.3"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"python-pysaml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.5.0-4.3.3"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"python-pytest","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.7.4-3.3.3"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"python-urllib3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.23-3.15.3"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"release-notes-suse-openstack-cloud","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.20200917-3.24.3"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"spark","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.3-5.3.3"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"venv-openstack-barbican","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.1~dev24-3.21.2"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"venv-openstack-cinder","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"13.0.10~dev20-3.24.2"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"venv-openstack-designate","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.2~dev2-3.21.2"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"venv-openstack-glance","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17.0.1~dev30-3.19.2"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"venv-openstack-heat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.0.4~dev4-3.21.2"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"venv-openstack-horizon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.1.1~dev7-4.23.2"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"venv-openstack-ironic","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.1.5~dev16-4.19.2"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"venv-openstack-keystone","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.2.1~dev4-3.21.2"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"venv-openstack-magnum","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2.1~dev1-4.21.2"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"venv-openstack-manila","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4.2~dev57-3.25.2"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"venv-openstack-monasca","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.1~dev10-3.19.2"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"venv-openstack-monasca-ceilometer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.2~dev3-3.21.2"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"venv-openstack-neutron","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"13.0.8~dev135-6.23.2"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"venv-openstack-nova","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.3.1~dev77-3.23.2"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"venv-openstack-octavia","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.3~dev7-4.21.2"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"venv-openstack-sahara","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.2~dev15-3.21.2"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"venv-openstack-swift","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.19.2~dev48-2.16.2"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"crowbar-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0+git.1606314264.bf9ada813-3.31.2"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"crowbar-openstack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0+git.1604573541.bb18c172d-3.28.3"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"grafana","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.7.4-3.20.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"influxdb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.8-4.3.3"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"openstack-cinder","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"13.0.10~dev20-3.28.2"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"openstack-heat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.0.4~dev4-3.19.2"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"openstack-heat-gbp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.0.1~dev2-3.3.4"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"openstack-heat-templates","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.0+git.1605509190.64f020b6-3.9.3"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"openstack-horizon-plugin-gbp-ui","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.0.1~dev3-3.3.4"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"openstack-ironic-python-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.4~dev6-3.19.4"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"openstack-manila","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4.2~dev57-4.30.2"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"openstack-neutron","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"13.0.8~dev135-3.31.2"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"openstack-neutron-gbp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.0.1~dev5-3.19.4"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"openstack-neutron-vpnaas","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"13.0.2~dev6-3.9.2"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"openstack-nova","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.3.1~dev77-3.31.2"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"python-Jinja2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.10.1-3.3.3"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"python-pysaml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.5.0-4.3.3"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"python-pytest","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.7.4-3.3.3"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"python-urllib3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.23-3.15.3"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"release-notes-suse-openstack-cloud","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.20200917-3.24.3"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"spark","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.3-5.3.3"}]}],"bundled":7},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"influxdb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.1+dfsg1-4+deb9u1ubuntu1"}]}],"versions":["1.1.1+dfsg1-4"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"influxdb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.4-1+deb10u1build0.20.04.1"}]}],"versions":["1.6.4-1build1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"influxdb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.7~rc0-1"}]}]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"influxdb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.1+dfsg1-4+deb9u1ubuntu1"}]}],"versions":["1.1.1+dfsg1-4"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"influxdb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.4-1+deb10u1build0.20.04.1"}]}],"versions":["1.6.4-1build1"]}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"influxdata","product":"influxdb"}],"references":[{"url":"https://github.com/influxdata/influxdb/issues/12927","tags":["x_refsource_MISC","x_transferred","Issue Tracking","Third Party Advisory","report","web"]},{"url":"https://github.com/influxdata/influxdb/compare/v1.7.5...v1.7.6","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","web","report"]},{"url":"https://github.com/influxdata/influxdb/commit/761b557315ff9c1642cf3b0e5797cd3d983a24c0","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","web","report"]},{"url":"https://lists.debian.org/debian-lts-announce/2020/12/msg00030.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","advisory","web"]},{"url":"https://www.debian.org/security/2021/dsa-4823","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-20933","tags":["advisory"]},{"url":"https://github.com/ticarpi/jwt_tool/blob/a6ca3e0524a204b5add070bc6874cb4e7e5a9864/jwt_tool.py#L1368","tags":["web"]},{"url":"https://github.com/advisories/GHSA-2rmp-fw5r-j5qv","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2019-20933","tags":["advisory"]},{"url":"https://pkg.go.dev/github.com/influxdata/influxdb/services/httpd","tags":["package"]},{"url":"https://www.suse.com/support/update/announcement/2020/suse-su-20203624-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1005886","tags":["report"]},{"url":"https://bugzilla.suse.com/1170479","tags":["report"]},{"url":"https://bugzilla.suse.com/1177120","tags":["report"]},{"url":"https://bugzilla.suse.com/1178243","tags":["report"]},{"url":"https://bugzilla.suse.com/1178988","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2016-8611","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-20933","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-9740","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-24303","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-26137","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2020/suse-su-20203897-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1125815","tags":["report"]},{"url":"https://bugzilla.suse.com/1132174","tags":["report"]},{"url":"https://bugzilla.suse.com/1132323","tags":["report"]},{"url":"https://bugzilla.suse.com/1160851","tags":["report"]},{"url":"https://bugzilla.suse.com/1177611","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2016-10745","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-10906","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-8341","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-5390","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2019-20933","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-5451-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-20933","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2019-20933","description":"InfluxDB before 1.7.6 has an authentication bypass vulnerability in the authenticate function in services/httpd/handler.go because a JWT token may have an empty SharedSecret (aka shared secret).","status":"published","published":"2020-11-19T01:50:50Z","modified":"2024-08-05T03:00:18.714Z","updated_at":"2026-11-02T14:20:17.431882Z"}],"euvd":[{"id":"EUVD-2021-0904","description":"InfluxDB before 1.7.6 has an authentication bypass vulnerability in the authenticate function in services/httpd/handler.go because a JWT token may have an empty SharedSecret (aka shared secret).","status":"published","published":"2020-11-19T01:50:50Z","modified":"2024-08-05T03:00:18Z","updated_at":"2026-11-03T02:40:19.824838Z"}],"ghsa":[{"id":"GHSA-2rmp-fw5r-j5qv","title":"Improper Authentication in InfluxDB","description":"InfluxDB before 1.7.6 has an authentication bypass vulnerability in the authenticate function in `services/httpd/handler.go` because a JWT token may have an empty SharedSecret (aka shared secret).","status":"published","published":"2021-05-18T18:22:05Z","modified":"2023-10-02T15:14:39Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-287"],"updated_at":"2026-11-02T14:37:07.641671Z"}],"nvd":[{"id":"CVE-2019-20933","description":"InfluxDB before 1.7.6 has an authentication bypass vulnerability in the authenticate function in services/httpd/handler.go because a JWT token may have an empty SharedSecret (aka shared secret).","status":"published","published":"2020-11-19T02:15:11.913Z","modified":"2026-06-17T02:31:27.15Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"cwes":["CWE-287"],"updated_at":"2026-11-02T14:05:48.502374Z"}],"osv":[{"id":"CVE-2019-20933","description":"InfluxDB before 1.7.6 has an authentication bypass vulnerability in the authenticate function in services/httpd/handler.go because a JWT token may have an empty SharedSecret (aka shared secret).","status":"published","published":"2020-11-19T02:15:11.913Z","modified":"2026-10-20T10:52:40.859528201Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:44:12.363788Z"},{"id":"DEBIAN-CVE-2019-20933","description":"InfluxDB before 1.7.6 has an authentication bypass vulnerability in the authenticate function in services/httpd/handler.go because a JWT token may have an empty SharedSecret (aka shared secret).","status":"published","published":"2020-11-19T02:15:11.913Z","modified":"2026-09-21T07:01:02.431187527Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:45:32.221385Z"},{"id":"GHSA-2rmp-fw5r-j5qv","title":"Improper Authentication in InfluxDB","description":"InfluxDB before 1.7.6 has an authentication bypass vulnerability in the authenticate function in `services/httpd/handler.go` because a JWT token may have an empty SharedSecret (aka shared secret).","status":"published","published":"2021-05-18T18:22:05Z","modified":"2024-08-21T15:58:54.479596Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-287"],"updated_at":"2026-11-02T15:46:34.700741Z"},{"id":"UBUNTU-CVE-2019-20933","description":"InfluxDB before 1.7.6 has an authentication bypass vulnerability in the authenticate function in services/httpd/handler.go because a JWT token may have an empty SharedSecret (aka shared secret).","status":"published","published":"2020-11-19T02:15:00Z","modified":"2026-04-22T12:17:43.462775Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:54:21.213407Z"},{"id":"DLA-2501-1","title":"influxdb - security update","status":"published","published":"2020-12-20T00:00:00Z","modified":"2026-03-09T01:21:06.515509Z","updated_at":"2026-11-02T15:46:10.712745Z"},{"id":"DSA-4823-1","title":"influxdb - security update","status":"published","published":"2021-01-01T00:00:00Z","modified":"2026-03-09T02:10:47.929022Z","updated_at":"2026-11-02T15:46:17.19998Z"},{"id":"GO-2022-0780","title":"Improper Authentication in InfluxDB in github.com/influxdata/influxdb","description":"Improper Authentication in InfluxDB in github.com/influxdata/influxdb","status":"published","published":"2024-08-21T15:28:59Z","modified":"2026-03-03T04:50:53.394756Z","updated_at":"2026-11-02T15:47:00.918515Z"},{"id":"SUSE-SU-2020:3624-1","title":"Security update for crowbar-openstack, grafana, influxdb, python-urllib3","description":"This update for crowbar-openstack, grafana, influxdb, python-urllib3 contains the following fixes:\n\nSecurity fixes included in this update:\n\nopenstack-glance\n- CVE-2016-8611: Added rate limiting for glance api (bnc#1005886)\n\ngrafana\n- CVE-2020-24303: Fixed an XSS via a query alias for the ElasticSearch datasource (#bnc#1178243)\n\ninfluxdb\n- CVE-2019-20933: Fixed an authentication bypass (bnc#1178988)\n\npython-urlib3\n- CVE-2019-9740: Fixed a CRLF injection in urllib3 (bnc#1129071).\n- CVE-2020-26137: Fixed a CRLF injection via HTTP request method (bnc#1177120)\n\nmemcached\n- CVE-2018-1000115: Fixed a issue where a UDP server allowed spoofed traffic amplification DoS (bnc#1083903).\n\nNon-security fixes included in this update:\n\nChanges in crowbar-openstack:\n- Update to version 4.0+git.1604938545.30c10db18:\n  * rabbitmq: Fix crm running check (SOC-11240)\n\nChanges in grafana:\n- Fix bnc#1178243 CVE-2020-24303 by adding\n  25401-Fix-XSS-vulnerability-with-series-overrides.patch\n\nChanges in influxdb:\n- Add CVE-2019-20933.patch (bnc#1178988, CVE-2019-20933) to\n  fix authentication bypass_\n- Declare license files correctly\n\n- Version 1.2.4:\n  * The stress tool influx_stress will be removed in a subsequent\n    release.\n  * Remove the override of GOMAXPROCS.\n  * Uncomment section headers from the default configuration file.\n  * Improve write performance significantly.\n  * Prune data in meta store for deleted shards.\n  * Update latest dependencies with Godeps.\n  * Introduce syntax for marking a partial response with chunking.\n  * Use X-Forwarded-For IP address in HTTP logger if present.\n  * Add support for secure transmission via collectd.\n  * Switch logging to use structured logging everywhere.\n  * [CLI feature request] USE retention policy for queries.\n  * Add clear command to cli.\n  * Adding ability to use parameters in queries in the v2 client\n    using the Parameters map in the Query struct.\n  * Allow add items to array config via ENV\n  * Support subquery execution in the query language.\n  * Verbose output for SSL connection errors.\n  * Cache snapshotting performance improvements\n\n- Partially revert previous change to fix build for Leap\n\nChanges in python-urllib3:\n- Update urllib3-fix-test-urls.patch. Adjust to match upstream solution.\n\n- Add urllib3-fix-test-urls.patch. Fix tests failing on python checks for\n  CVE-2019-9740.\n\n- Add urllib3-cve-2020-26137.patch. Don't allow control chars in request\n  method. (bnc#1177120, CVE-2020-26137)\n\n  ","status":"published","published":"2020-12-04T11:50:23Z","modified":"2025-05-02T04:10:02.691016Z","updated_at":"2026-11-02T15:53:48.690034Z"},{"id":"SUSE-SU-2020:3897-1","title":"Security update for ardana-cassandra, ardana-mq, ardana-osconfig, ardana-tempest, crowbar-core, crowbar-openstack, grafana, influxdb, openstack-cinder, openstack-heat, openstack-heat-gbp, openstack-heat-templates, openstack-horizon-plugin-gbp-ui, openstack-ironic-python-agent, openstack-manila, openstack-neutron, openstack-neutron-gbp, openstack-neutron-vpnaas, openstack-nova, python-Jinja2, python-pysaml2, python-pytest, python-urllib3, release-notes-suse-openstack-cloud, spark","description":"This update for ardana-cassandra, ardana-mq, ardana-osconfig, ardana-tempest, crowbar-core, crowbar-openstack, grafana, influxdb, openstack-cinder, openstack-heat, openstack-heat-gbp, openstack-heat-templates, openstack-horizon-plugin-gbp-ui, openstack-ironic-python-agent, openstack-manila, openstack-neutron, openstack-neutron-gbp, openstack-neutron-vpnaas, openstack-nova, python-Jinja2, python-pysaml2, python-pytest, python-urllib3, release-notes-suse-openstack-cloud, spark fixes the following issues:\n\nSecurity changes included on this update:\n\ngrafana:\n- CVE-2020-24303: Fixed an XXS with series overides. (bsc#1178243)\n\ninfluxdb:\n- CVE-2019-20933: Fixed an authentication bypass. (bsc#1178988)\n\npython-Jinja2:\n- CVE-2019-10906,CVE-2019-8341,CVE-2016-10745: 'SandboxedEnvironment' securely handles 'str.format_map' in order\n  to prevent code execution through untrusted format strings. (bsc#1132323, bsc#1125815, bsc#1132174)\n\npython-pysaml2:\n- CVE-2020-5390: Fixed an issue where there was no check that the signature in a SAML document is enveloped. (bsc#1160851)\n\npython-urllib3:\n- CVE-2020-26137: Fixed a CRLF injection via HTTP request method. (bsc#1177120)\n\nNon-security changes included in this update:\n\nChanges in ardana-cassandra:\n- Update to version 9.0+git.1600802664.7e480a2:\n  * Remove freezer related backup/restore code (SOC-7751)\n\nChanges in ardana-mq:\n- Update to version 9.0+git.1605174486.a78ddce:\n  * Re-enable mirroring of fanout and reply queues (bsc#1177611)\n\nChanges in ardana-osconfig:\n- Update to version 9.0+git.1601621747.a87e5a0:\n  * HOS8 check needs to be a shell rather than command (SOC-11184)\n\nChanges in ardana-tempest:\n- Update to version 9.0+git.1603378983.fc0bca9:\n  * Enable VPNaaS testing (SOC-8764)\n\n- Update to version 9.0+git.1599855218.875b2f3:\n  * unblacklist some revert tests (SOC-9178)\n\nChanges in crowbar-core:\n- Update to version 6.0+git.1606314264.bf9ada813:\n  * ntp: Do not use rate-limiting (bsc#1179161)\n\n- Update to version 6.0+git.1600414599.150832ca2:\n  * Ignore CVE-2020-15169 (SOC-11391)\n\nChanges in crowbar-openstack:\n- Update to version 6.0+git.1604573541.bb18c172d:\n  * rabbitmq: Fix crm running check (SOC-11240)\n\n- Update to version 6.0+git.1604491402.b4dbba849:\n  * Remove aspiers from CODEOWNERS\n  * Remove cmurphy from CODEOWNERS\n\nChanges in grafana:\n- Fix bsc#1178243 CVE-2020-24303 by adding\n  25401-Fix-XSS-vulnerability-with-series-overrides.patch \n\nChanges in influxdb:\n- Add CVE-2019-20933.patch (bsc#1178988, CVE-2019-20933) to\n  fix authentication bypass \n- Declare license files correctly\n\nChanges in openstack-cinder:\n- Update to version cinder-13.0.10.dev20:\n  * PowerMax Driver - Legacy volumes fail to live migrate\n\n- Update to version cinder-13.0.10.dev19:\n  * RBD: Cleanup temporary file during exception\n\n- Update to version cinder-13.0.10.dev17:\n  * Remove experimental job legacy-tempest-dsvm-zeromq-multibackend\n\nChanges in openstack-cinder:\n- Update to version cinder-13.0.10.dev20:\n  * PowerMax Driver - Legacy volumes fail to live migrate\n\n- Update to version cinder-13.0.10.dev19:\n  * RBD: Cleanup temporary file during exception\n\n- Update to version cinder-13.0.10.dev17:\n  * Remove experimental job legacy-tempest-dsvm-zeromq-multibackend\n\nChanges in openstack-heat:\n- Update to version openstack-heat-11.0.4.dev4:\n  * Check external resources after creation\n\n- Update to version openstack-heat-11.0.4.dev2:\n  * Don't store signal\\_url for ec2 signaling of deployments\n  * Allow scale-down of ASG as part of update\n  11.0.3\n\nChanges in openstack-heat:\n- Update to version openstack-heat-11.0.4.dev4:\n  * Check external resources after creation\n\n- Update to version openstack-heat-11.0.4.dev2:\n  * Don't store signal\\_url for ec2 signaling of deployments\n  * Allow scale-down of ASG as part of update\n  11.0.3\n\nChanges in openstack-heat-gbp:\n- Update to version group-based-policy-automation-12.0.1.dev2:\n  * Add support for victoria\n\n- Update to version group-based-policy-automation-12.0.1.dev1:\n  * Add network\\_id field for L2 Policy Heat Extensions\n  12.0.0\n  * Add support for ussuri\n  * Fix master/train gate\n  * Add support for train\n  10.0.0\n  * Upgrade for stable/stein branch\n  9.0.0\n  * Updated with 'stable/rocky' branch\n  * Replace openstack.org URLs with 'git+https://'\n  * OpenDev Migration Patch\n\nChanges in openstack-heat-templates:\n- Update to version 0.0.0+git.1605509190.64f020b:\n  * Fix software config on rdo\n  * optimize size and time using --no-cache-dir\n  * add template for servers using Octavia\n\n- Update to version 0.0.0+git.1604032742.c5733ee:\n  * Move heat-templates-check job to zuul v3\n\nChanges in openstack-horizon-plugin-gbp-ui:\n- Update to version group-based-policy-ui-12.0.1.dev3:\n  * Remove mox3 from requirements\n\n- Update to version group-based-policy-ui-12.0.1.dev2:\n  * Fix python namespacing\n  * Add stable victoria\n  12.0.0\n  * Add support for ussuri\n  * Fix master/train gate\n  * Add support for train\n  10.0.0\n  * Upgrade for stable/stein branch\n  9.0.0\n  * Upgrading for stable/rocky branch\n  * Added Python3 support\n  * OpenDev Migration Patch\n\nChanges in openstack-ironic-python-agent:\n- Update to version ironic-python-agent-3.3.4.dev6:\n  * Fix: make Intel CNA hardware manager none generic\n\nChanges in openstack-manila:\n- Update to version manila-7.4.2.dev57:\n  * fix reno file location and indention\n\n- Update to version manila-7.4.2.dev56:\n  * [Glusterfs] Fix delete share, Couldn't find the 'gluster\\_used\\_vols'\n\n- Update to version manila-7.4.2.dev55:\n  * [Glusterfs] Fix delete share, mount point not disconnected\n\nChanges in openstack-manila:\n- Update to version manila-7.4.2.dev57:\n  * fix reno file location and indention\n\n- Update to version manila-7.4.2.dev56:\n  * [Glusterfs] Fix delete share, Couldn't find the 'gluster\\_used\\_vols'\n\n- Update to version manila-7.4.2.dev55:\n  * [Glusterfs] Fix delete share, mount point not disconnected\n\nChanges in openstack-neutron:\n- Update to version neutron-13.0.8.dev135:\n  * Rehome api tests for propagate\\_uplink\\_status\n\n- Update to version neutron-13.0.8.dev134:\n  * Revert '[Security] fix allowed-address-pair 0.0.0.0/0 issue'\n\n- Update to version neutron-13.0.8.dev132:\n  * Drop invalid rootwrap filters\n  * ovs firewall: fix mac learning on the ingress rule table when ovs offload enabled\n  * Add update\\_id for ResourceUpdate\n\n- Update to version neutron-13.0.8.dev126:\n  * 'ping'/'ping6' command support in rootwrap filters\n\n- Update to version neutron-13.0.8.dev124:\n  * Import 'oslo\\_config.cfg' before 'eventlet'\n  * [OvS] Handle re\\_added multi ports\n\n- Update to version neutron-13.0.8.dev120:\n  * Local mac direct flow for non-openflow firewall\n  * Replace ctype.CDLL by ctypes.PyDLL in linux.ip\\_lib\n\n- Update to version neutron-13.0.8.dev116:\n  * Support gateway which is not in subnet CIDR in ha\\_router\n  * Ensure fip ip rules deleted when fip removed\n\n- Update to version neutron-13.0.8.dev112:\n  * windows: fix terminating processes\n  * [stable/rocky] Drop rally job\n  * Don't raise FileNotFoundError during disabling keepalived\n  * Load the glibc library only once for Pyroute2\n\n- Update to version neutron-13.0.8.dev106:\n  * Do not fail deleting namespace if it does not exist\n\n- Update to version neutron-13.0.8.dev104:\n  * Avoid raising NetworkInterfaceNotFound exception in DHCP agent logs\n\n- Update to version neutron-13.0.8.dev103:\n  * Use dict .get() to avoid a KeyError in the segment plugin\n\n- Update to version neutron-13.0.8.dev101:\n  * Pass context in l3 flavor notifications\n  * Handle properly existing LLA address during l3 agent restart\n\n- Update to version neutron-13.0.8.dev97:\n  * Add 'keepalived\\_use\\_no\\_track' config option\n\nChanges in openstack-neutron:\n- Update to version neutron-13.0.8.dev135:\n  * Rehome api tests for propagate\\_uplink\\_status\n\n- Update to version neutron-13.0.8.dev134:\n  * Revert '[Security] fix allowed-address-pair 0.0.0.0/0 issue'\n\n- Update to version neutron-13.0.8.dev132:\n  * Drop invalid rootwrap filters\n  * ovs firewall: fix mac learning on the ingress rule table when ovs offload enabled\n  * Add update\\_id for ResourceUpdate\n\n- Update to version neutron-13.0.8.dev126:\n  * 'ping'/'ping6' command support in rootwrap filters\n\n- Update to version neutron-13.0.8.dev124:\n  * Import 'oslo\\_config.cfg' before 'eventlet'\n  * [OvS] Handle re\\_added multi ports\n\n- Update to version neutron-13.0.8.dev120:\n  * Local mac direct flow for non-openflow firewall\n  * Replace ctype.CDLL by ctypes.PyDLL in linux.ip\\_lib\n\n- Update to version neutron-13.0.8.dev116:\n  * Support gateway which is not in subnet CIDR in ha\\_router\n  * Ensure fip ip rules deleted when fip removed\n\n- Update to version neutron-13.0.8.dev112:\n  * windows: fix terminating processes\n  * [stable/rocky] Drop rally job\n  * Don't raise FileNotFoundError during disabling keepalived\n  * Load the glibc library only once for Pyroute2\n\n- Update to version neutron-13.0.8.dev106:\n  * Do not fail deleting namespace if it does not exist\n\n- Update to version neutron-13.0.8.dev104:\n  * Avoid raising NetworkInterfaceNotFound exception in DHCP agent logs\n\n- Update to version neutron-13.0.8.dev103:\n  * Use dict .get() to avoid a KeyError in the segment plugin\n\n- Update to version neutron-13.0.8.dev101:\n  * Pass context in l3 flavor notifications\n  * Handle properly existing LLA address during l3 agent restart\n\n- Update to version neutron-13.0.8.dev97:\n  * Add 'keepalived\\_use\\_no\\_track' config option\n\nChanges in openstack-neutron-gbp:\n- Update to version group-based-policy-12.0.1.dev5:\n  * Fix ICMP type and ICMP code fields for named and numbered ICMP Protocol\n  2014.2.0rc1\n\n- Update to version group-based-policy-12.0.1.dev4:\n  * Fix erroneous comma (,) in the LOG.exception call\n  2014.2rc1\n\n- Update to version group-based-policy-12.0.1.dev3:\n  * Fix top of tree in gate\n  * Endpoint level qos changes\n  12.0.0\n  * Add support for ussuri\n  * Update subnets for SVI port corresponding to bound port\n  * Fix the intermittent QOS UT failure\n  * Fixed the QOS UT failure\n  * Use train branch instead of stein\n  * Add support for train\n  * Prepare for removal of CommonDbMixin\n  * Make AIM dsvm job voting\n  * Add support for upstream Stein release\n  * Fix python2/3 compatibility\n  * Fix DNS Domain Name in endpoint file\n  * When a subnet added to a bound SVI port, ensure it is added to SVI port\n  * Add support for qos\n  * Fix DNS issue in endpoint file\n  * [AIM] Add pre-existing BD to network extension\n  * Remove get\\_current\\_session\n  * Remove get\\_current\\_session method\n  * [AIM] Add EPG contract masters to network extension\n  * Revert 'Remove get\\_current\\_session method'\n  * Remove get\\_current\\_session method\n  * Support Dual Stack on SVI nets along with BGP\n  9.0.0\n  * Add support for upstream Rocky release\n  * Cleanup Queens (part 2)\n  * Fix missing DB migration\n  * Make aim functional gate job voting\n  * Added Python3 support\n  * [AIM] Sanitize the AIM tenant description field\n  * Fix field sizes for VM names\n  * Bind baremetal VNIC trunk ports\n  * Fix missing trunk\\_details for a trunk without subports\n  * [AIM] Insert remote\\_group\\_id to SG rules properly\n  * Revert '[AIM] Convert remote\\_ips for SG rules properly'\n  * Cleanup Queens\n  * [AIM] Convert remote\\_ips for SG rules properly\n  * Clean up baremetal port handling\n  * [AIM] Clean up the mock and stop the looping thread in the UT env\n  * Don't stop this looping thread when an exception is thrown\n  * [AIM] Fix router\\_id allocation for SVI\n  * Support non SVI static VLAN type segments with OpFlex agent\n  * Baremetal VNIC Trunk support\n  * [AIM] Don't queue notifications (4 of 4)\n  * [AIM] Don't queue registry callbacks (3 of 4)\n  * [AIM] Enable Neutron transaction guards (2 of 4)\n  * Don't call GBP or Neutron APIs from GBP PD precommit methods\n  * [AIM] Retry L3 Plugin Operations\n  * [AIM] Fix most common random UT failures\n  * [AIM] Fixed external subnet ANY\\_CIDRs for l3out EPGs for SVI\n  * Revert 'Nested domain parameters support for openShift networks'\n  * Fix for unbinding baremetal VNIC ports\n  * Nested domain parameters support for openShift networks\n  * Fix tox coverage job\n  * Add suport for baremetal vnic\\_type\n  2014.2.rc1\n\nChanges in openstack-neutron-vpnaas:\n- Remove remove-tempest-entry-point.patch thus enabling the\n  tempest_vpnaas plugin for tempest testing. (SCRD-8681)\n- Package the neutron-vpnaas/tests/ directory contents in a new RPM\n  RPM package, python-neutron-vpnaas-tempest-plugin, that depend on\n  python-neutron-vpnaas, which provides the main neutron-vpnaas\n  code base. Additionally this new package can now safely depend on\n  the python-neutron-tempest-plugin package, providing the required\n  neutron_tempest_plugin module, without causing tempest packages\n  to be installed when python-neutron-vpnaas installed. (SOC-8764)\n  NOTE: This implicitly enables the neutron_tempest_plugin.\n- Corrected LBaaS references to VPNaaS.\n\nChanges in openstack-nova:\n- Update to version nova-18.3.1.dev77:\n  * Follow up for cherry-pick check for merge patch\n\n- Update to version nova-18.3.1.dev76:\n  * post live migration: don't call Neutron needlessly\n\n- Update to version nova-18.3.1.dev74:\n  * libvirt: Do not reference VIR\\_ERR\\_DEVICE\\_MISSING when libvirt is smaller than v4.1.0\n\n- Update to version nova-18.3.1.dev72:\n  * libvirt: Handle VIR\\_ERR\\_DEVICE\\_MISSING when detaching devices\n\n- Update to version nova-18.3.1.dev70:\n  * compute: Don't delete the original attachment during pre LM rollback\n  * Add regression tests for bug #1889108\n  * compute: refactor volume bdm rollback error handling\n\n- Update to version nova-18.3.1.dev64:\n  * compute: Use source\\_bdms to reset attachment\\_ids during LM rollback\n  * Robustify attachment tracking in CinderFixtureNewAttachFlow\n\n- Update to version nova-18.3.1.dev60:\n  * Improve CinderFixtureNewAttachFlow\n\n- Update to version nova-18.3.1.dev58:\n  * Removed the host FQDN from the exception message\n\n- Update to version nova-18.3.1.dev56:\n  * libvirt: Provide VIR\\_MIGRATE\\_PARAM\\_PERSIST\\_XML during live migration\n\nChanges in openstack-nova:\n- Update to version nova-18.3.1.dev77:\n  * Follow up for cherry-pick check for merge patch\n\n- Update to version nova-18.3.1.dev76:\n  * post live migration: don't call Neutron needlessly\n\n- Update to version nova-18.3.1.dev74:\n  * libvirt: Do not reference VIR\\_ERR\\_DEVICE\\_MISSING when libvirt is smaller than v4.1.0\n\n- Update to version nova-18.3.1.dev72:\n  * libvirt: Handle VIR\\_ERR\\_DEVICE\\_MISSING when detaching devices\n\n- Update to version nova-18.3.1.dev70:\n  * compute: Don't delete the original attachment during pre LM rollback\n  * Add regression tests for bug #1889108\n  * compute: refactor volume bdm rollback error handling\n\n- Update to version nova-18.3.1.dev64:\n  * compute: Use source\\_bdms to reset attachment\\_ids during LM rollback\n  * Robustify attachment tracking in CinderFixtureNewAttachFlow\n\n- Update to version nova-18.3.1.dev60:\n  * Improve CinderFixtureNewAttachFlow\n\n- Update to version nova-18.3.1.dev58:\n  * Removed the host FQDN from the exception message\n\n- Rebased patches:\n  + 0004-Provide-VIR_MIGRATE_PARAM_PERSIST_XML-during-live-migration.patch dropped (merged upstream)\n\n- Update to version nova-18.3.1.dev56:\n  * libvirt: Provide VIR\\_MIGRATE\\_PARAM\\_PERSIST\\_XML during live migration\n\nChanges in python-Jinja2:\n- Trim bias from descriptions. Make sure % is escaped.\n\n- update to version 2.10.1 (bsc#1132323, CVE-2019-10906, bsc#1125815, CVE-2019-8341):\n  * 'SandboxedEnvironment' securely handles 'str.format_map' in order\n    to prevent code execution through untrusted format strings.  The\n    sandbox already handled 'str.format'.\n\n- Activate test suite\n- Add minimum build dependency to match runtime dependency\n\n- Fix fdupes call\n\n- Remove superfluous devel dependency for noarch package\n\n- Update to 2.9.5 (bsc#1132174, CVE-2016-10745)\nChanges in python-pysaml2:\n- Add 0001-Fix-XML-Signature-Wrapping-XSW-vulnerabilities.patch\n  (CVE-2020-5390, bsc#1160851)\n\nChanges in python-pytest:\n- update to 3.7.4\n- drop 0001-Use-unittest.mock-if-is-only-aviable.patch\n * Fix possible infinite recursion when writing .pyc files\n * Cache plugin now obeys the -q flag when --last-failed and\n     --failed-first flags are used.\n * Fix bad console output when using console_output_style=classic\n * Fixtures during teardown can again use capsys and capfd to inspect\n     output captured during tests.\n * Fix bugs where unicode arguments could not be passed to testdir.runpytest\n     on Python 2.\n * Fix double collection of tests within packages when the filename starts\n     with a capital letter\n * Fix collection error when specifying test functions directly in the command\n     line using test.py::test syntax together with --doctest-modules\n  * Fix stdout/stderr not getting captured when real-time cli logging is active.\n  * Fix bug where --show-capture=no option would still show logs printed during\n     fixture teardown.\n  * Fix issue where teardown of fixtures of consecutive sub-packages were\n     executed once, at the end of the outer package.\n\n- update to 3.7.2\n- add 0001-Use-unittest.mock-if-is-only-aviable.patch\n * Fix filterwarnings not being registered as a builtin mark.\n * Fix test collection from packages mixed with normal directories.\n * Fix infinite recursion during collection if a pytest_ignore_collect\n    hook returns False instead of None.\n * Fix bug where decorated fixtures would lose functionality\n * Fix bug where importing modules or other objects with prefix pytest_ prefix\n    would raise a PluginValidationError.\n * Fix AttributeError during teardown of TestCase subclasses which raise\n    an exception during __init__.\n * Fix traceback reporting for exceptions with __cause__ cycles.\n\nChanges in python-pytest:\n- update to 3.7.4\n- drop 0001-Use-unittest.mock-if-is-only-aviable.patch\n * Fix possible infinite recursion when writing .pyc files\n * Cache plugin now obeys the -q flag when --last-failed and\n     --failed-first flags are used.\n * Fix bad console output when using console_output_style=classic\n * Fixtures during teardown can again use capsys and capfd to inspect\n     output captured during tests.\n * Fix bugs where unicode arguments could not be passed to testdir.runpytest\n     on Python 2.\n * Fix double collection of tests within packages when the filename starts\n     with a capital letter\n * Fix collection error when specifying test functions directly in the command\n     line using test.py::test syntax together with --doctest-modules\n  * Fix stdout/stderr not getting captured when real-time cli logging is active.\n  * Fix bug where --show-capture=no option would still show logs printed during\n     fixture teardown.\n  * Fix issue where teardown of fixtures of consecutive sub-packages were\n     executed once, at the end of the outer package.\n\n- update to 3.7.2\n- add 0001-Use-unittest.mock-if-is-only-aviable.patch\n * Fix filterwarnings not being registered as a builtin mark.\n * Fix test collection from packages mixed with normal directories.\n * Fix infinite recursion during collection if a pytest_ignore_collect\n    hook returns False instead of None.\n * Fix bug where decorated fixtures would lose functionality\n * Fix bug where importing modules or other objects with prefix pytest_ prefix\n    would raise a PluginValidationError.\n * Fix AttributeError during teardown of TestCase subclasses which raise\n    an exception during __init__.\n * Fix traceback reporting for exceptions with __cause__ cycles.\n\nChanges in python-urllib3:\n- Update urllib3-fix-test-urls.patch. Adjust to match upstream solution.\n\n- Add urllib3-fix-test-urls.patch. Fix tests failing on python checks for\n  CVE-2019-9740.\n\n- Add urllib3-cve-2020-26137.patch. Don't allow control chars in request\n  method. (bsc#1177120, CVE-2020-26137)\n\nChanges in release-notes-suse-openstack-cloud:\n- Update to version 9.20200917:\n  * Change wording to correctly refer to future SES versions\n  * Update adoc/limitations.adoc\n  * Add SES version limitation, remove deprecated note about Octavia for Crowbar\n\n- Update to version 9.20200917:\n  * Announce Upgrade is now available (SOC-9781)\n\nChanges in spark:\n- Add _constraints to prevent build from running out of disk space \n\n  ","status":"published","published":"2020-12-21T12:51:34Z","modified":"2026-02-04T04:16:03.397106Z","updated_at":"2026-11-02T15:53:48.690034Z"},{"id":"USN-5451-1","title":"influxdb vulnerability","description":"Ilya Averyanov discovered that an InfluxDB vulnerability allowed\nattackers to bypass authentication and gain access to any known\ndatabase user.\n","status":"published","published":"2022-05-31T17:43:25Z","modified":"2026-04-22T10:24:31.160859Z","updated_at":"2026-11-02T16:58:16.20937Z"}]}}