CVE-2019-19316: Use of a Broken or Risky Cryptographic Algorithm in Terraform
Summary
CVE-2019-19316: Use of a Broken or Risky Cryptographic Algorithm in Terraform. Affects github.com/hashicorp/terraform versions < 0.12.17. Fixed in 0.12.17. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The package under scrutiny is github.com/hashicorp/terraform/backend/remote-state/azure, which is a Go package used in Terraform for managing remote state in Azure. It provides functionality for storing and retrieving Terraform state files in Azure Blob Storage. The package is vulnerable to a cryptographic algorithm issue that affects versions prior to 0.12.17 of Terraform.
Vulnerability Detail
The vulnerability (CVE-2019-19316) arises when using the Azure backend with a shared access signature (SAS) in Terraform versions prior to 0.12.17. In such cases, the token and state snapshot are transmitted using cleartext HTTP, which exposes them to potential interception and unauthorized access. This can lead to the compromise of sensitive information and unauthorized modifications to the Terraform state.
How To Fix
Latest published version: v1.17.0 as of 22 Oct 2026
go get github.com/hashicorp/terraform@v1.17.0Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.12.17
This is the first release that contains the fix.
go get github.com/hashicorp/terraform@v0.12.17Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version of Terraform is not immediately feasible, a workaround can be implemented by manually encrypting the token and state snapshot before transmission. This can be achieved using a secure encryption algorithm and ensuring the use of HTTPS for transmission. However, this workaround is not recommended as it adds complexity and potential risks. It is strongly advised to upgrade to the fixed version of Terraform as soon as possible.
Conclusion
In conclusion, the github.com/hashicorp/terraform/backend/remote-state/azure package in Terraform versions prior to 0.12.17 is vulnerable to the use of a broken or risky cryptographic algorithm. This can lead to the exposure of sensitive information and unauthorized modifications to the Terraform state. It is crucial to upgrade to the fixed version of Terraform or implement the recommended workaround to mitigate these risks. For further support, contact DevNack.com.
See every vulnerability recorded for github.com/hashicorp/terraform →
FAQ
This vulnerability exposes the token and state snapshot to potential interception and unauthorized access. Attackers could gain access to sensitive information and make unauthorized modifications to the Terraform state, potentially leading to further security breaches or unauthorized changes to infrastructure.
You can use Vulert's playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities, using Gopkg.lock as input. It does not require access to the code or installation.
The CVSS score of this vulnerability is 3.7, indicating a medium level of severity.
There are no known public exploits for this vulnerability at the time of this report. However, it is important to address the vulnerability promptly to mitigate potential risks.
For further support on vulnerability remediation, you can reach out to info@devnack.com. The DevNack team can provide guidance and assistance in addressing this vulnerability.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/hashicorp/terraform.
