This page tracks the Debian fix status. The vulnerability itself is described on the main CVE page.
View CVE-2019-20933 →
DEBIAN-CVE-2019-20933
InfluxDB before 1.7.6 has an authentication bypass vulnerability in the authenticate function in services/httpd/handler.go because a JWT token may hav...
Original description
The description as published by the source.
InfluxDB before 1.7.6 has an authentication bypass vulnerability in the authenticate function in services/httpd/handler.go because a JWT token may have an empty SharedSecret (aka shared secret).
Source: OSV.dev (Open Source Vulnerabilities) OSV
Affected packages
Debian:12
influxdb
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.7~rc0-1"}]}]
Debian:13
influxdb
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.7~rc0-1"}]}]
Debian:14
influxdb
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.7~rc0-1"}]}]
References
- advisory security-tracker.debian.org