CVE-2019-20933
First published: Thu Nov 19 2020(Updated: )
InfluxDB before 1.7.6 has an authentication bypass vulnerability in the authenticate function in `services/httpd/handler.go` because a JWT token may have an empty SharedSecret (aka shared secret).
Credit: cve@mitre.org cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| go/github.com/influxdata/influxdb | <1.7.6 | 1.7.6 |
| debian/influxdb | 1.6.4-1+deb10u1 1.6.7~rc0-1 1.6.7~rc0-2 | |
| influxData influxDB | <1.7.6 | |
| Debian Debian Linux | =9.0 | |
| Debian Debian Linux | =10.0 | |
| Debian | =9.0 | |
| Debian | =10.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://nvd.nist.gov/vuln/detail/CVE-2019-20933
- https://github.com/influxdata/influxdb/issues/12927
- https://github.com/influxdata/influxdb/commit/761b557315ff9c1642cf3b0e5797cd3d983a24c0
- https://github.com/influxdata/influxdb/compare/v1.7.5...v1.7.6
- https://github.com/ticarpi/jwt_tool/blob/a6ca3e0524a204b5add070bc6874cb4e7e5a9864/jwt_tool.py#L1368
- https://lists.debian.org/debian-lts-announce/2020/12/msg00030.html
- https://www.debian.org/security/2021/dsa-4823
- https://github.com/advisories/GHSA-2rmp-fw5r-j5qv (Advisory)
- https://security-tracker.debian.org/tracker/CVE-2019-20933
- collector/github-advisory-latest
- alias/GHSA-2rmp-fw5r-j5qv
- alias/CVE-2019-20933
- collector/github-advisory
- collector/security-tracker-debian
- agent/author
- agent/type
- agent/remedy
- agent/softwarecombine
- collector/nvd-index
- agent/software-canonical-lookup
- collector/mitre-cve
- source/MITRE
- agent/references
- agent/last-modified-date
- agent/severity
- agent/weakness
- agent/description
- agent/first-publish-date
- agent/event
- agent/trending
- agent/source
- agent/tags
- collector/nvd-cve
- agent/software-canonical-lookup-request
- package-manager/go
- package-manager/debian
- vendor/influxdata
- canonical/influxdata influxdb
- vendor/debian
- canonical/debian debian linux
- version/debian debian linux/9.0
- version/debian debian linux/10.0
- canonical/debian
- version/debian/9.0
- version/debian/10.0