What’s Vulnerable › Vulnerabilities

CVE-2019-19316

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.0% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2019-12-02 · updated 2026-06-17
• Weakness: CWE-319

Description

When using the Azure backend with a shared access signature (SAS), Terraform versions prior to 0.12.17 may transmit the token and state snapshot using cleartext HTTP.

Affected products

• HashiCorp Terraform: before 0.12.17 — fixed in 0.12.17

How to fix

Upgrade to a fixed version: HashiCorp Terraform 0.12.17. Check the vendor advisory for mitigations.

References

• https://github.com/hashicorp/terraform/security/advisories/GHSA-4rvg-555h-r626
• https://github.com/hashicorp/terraform/security/advisories/GHSA-4rvg-555h-r626

Get alerted when CVE-2019-19316 or the next vulnerability affects your stack