CVE-2019-19316: Use of a Broken or Risky Cryptographic Algorithm in Terraform
Summary
CVE-2019-19316: Use of a Broken or Risky Cryptographic Algorithm in Terraform in github.com/hashicorp/terraform. Affects github.com/hashicorp/terraform versions < 0.12.17. Fixed in 0.12.17. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Terraform is an open-source infrastructure as code software tool developed by HashiCorp. It allows users to define and provision infrastructure resources in a declarative configuration language. Terraform supports various cloud providers and services, enabling the creation and management of infrastructure in a consistent and efficient manner. However, a vulnerability has been identified in Terraform that involves the use of a broken or risky cryptographic algorithm.
Vulnerability Detail
The vulnerability in Terraform arises from the use of a cryptographic algorithm that is either broken or considered risky. This can lead to various security issues, such as weak encryption, insecure key generation, or susceptibility to cryptographic attacks. Attackers may exploit this vulnerability to gain unauthorized access, tamper with infrastructure resources, or compromise sensitive data. The vulnerability affects versions of Terraform prior to 0.12.17.
How To Fix
Latest published version: v1.17.0 as of 22 Oct 2026
go get github.com/hashicorp/terraform@v1.17.0Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.12.17
This is the first release that contains the fix.
go get github.com/hashicorp/terraform@v0.12.17Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
The use of a broken or risky cryptographic algorithm in Terraform poses a significant security risk. It is crucial to update to the latest version of Terraform (0.12.17 or later) to mitigate this vulnerability and ensure the security of infrastructure resources and sensitive data.
See every vulnerability recorded for github.com/hashicorp/terraform →
FAQ
Terraform is an open-source infrastructure as code software tool developed by HashiCorp. It allows users to define and provision infrastructure resources in a declarative configuration language.
The vulnerability in Terraform can lead to various security issues, such as weak encryption, insecure key generation, or susceptibility to cryptographic attacks. Attackers may exploit this vulnerability to gain unauthorized access, tamper with infrastructure resources, or compromise sensitive data.
Versions of Terraform prior to 0.12.17 are affected by this vulnerability.
To fix this vulnerability, it is recommended to update Terraform to version 0.12.17 or later. This update includes patches and improvements to the cryptographic algorithms used, ensuring stronger security and mitigating the risk of exploitation.
You can find more information about this vulnerability in the official Terraform documentation or the vulnerability database provided by the Go ecosystem.
Related vulnerabilities
Recent vulnerabilities recorded for github.com/hashicorp/terraform.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
