TerraformGHSA-h3p9-wrgx-82cm

Use of a Broken or Risky Cryptographic Algorithm in Terraform

CVE-2019-19316 · Published May 18, 2021 · updated Sep 10, 2026

High7.5

Fix: upgrade to 0.12.17 or later

When using the Azure backend with a shared access signature (SAS), Terraform versions prior to 0.12.17 may transmit the token and state snapshot using cleartext HTTP.

Specific Go Packages Affected

github.com/hashicorp/terraform/backend/remote-state/azure

Affected versions

Package	Affected	Fixed in
github.com/hashicorp/terraform Go	< 0.12.17	0.12.17

Details and references

CVSS 3.1: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Severity from: GitHub (reviewed advisory)
Weakness: CWE-20, CWE-327
Also known as: CVE-2019-19316, GHSA-4rvg-555h-r626, GO-2022-0839

github.com/hashicorp/terraform/security/advisories/GHSA-4rvg-555h-r626
nvd.nist.gov/vuln/detail/CVE-2019-19316
github.com/hashicorp/terraform/issues/23493
github.com/hashicorp/terraform/commit/6db3cf8e5b4cfb2a3cd1d99a813b50b2d5d363bb
github.com/hashicorp/terraform
pkg.go.dev/vuln/GO-2022-0839

More Terraform advisories

All Terraform

Medium 6.3Sep 8, 2023

Terraform allows arbitrary file write during the `init` operationCVE-2023-4782fixed in 1.5.7