CVE-2019-20933 - influxdb: authentication bypass because a JWT token may have an empty SharedSecret

Back Back to CVE browser

CRITICAL

influxdb: authentication bypass because a JWT token may have an empty SharedSecret

Published Nov 19, 2020

9.8

CRITICAL

CVSS 3.1

EPSS 30.92%

Description

InfluxDB before 1.7.6 has an authentication bypass vulnerability in the authenticate function in services/httpd/handler.go because a JWT token may have an empty SharedSecret (aka shared secret).

Affected products

Distributed Tracing Jaeger 1

jaeger-rhel8-operator

Not affected
OpenShift Service Mesh 1

servicemesh-prometheus

Not affected
OpenShift Service Mesh 2.0

servicemesh-prometheus

Not affected
Red Hat Advanced Cluster Management for Kubernetes 2

influxdb

Not affected
Red Hat Fuse 7

camel-influxdb

Not affected
Red Hat Fuse 7

camel-influxdb-starter

Not affected
Red Hat Fuse 7

influxdb-java

Not affected
Red Hat Integration Camel K 1

camel-influxdb

Not affected
Red Hat Integration Camel K 1

camel-quarkus-influxdb-deployment

Not affected
Red Hat Integration Camel K 1

camel-quarkus-influxdb-integration-test

Not affected
Red Hat Integration Camel K 1

influxdb-java

Not affected
Red Hat JBoss Fuse 6

influxdb-java

Not affected
Red Hat OpenShift Container Platform 4

openshift4/ose-prometheus

Not affected

Product	Package	State	Advisory
Distributed Tracing Jaeger 1	jaeger-rhel8-operator	Not affected	n/a
OpenShift Service Mesh 1	servicemesh-prometheus	Not affected	n/a
OpenShift Service Mesh 2.0	servicemesh-prometheus	Not affected	n/a
Red Hat Advanced Cluster Management for Kubernetes 2	influxdb	Not affected	n/a
Red Hat Fuse 7	camel-influxdb	Not affected	n/a
Red Hat Fuse 7	camel-influxdb-starter	Not affected	n/a
Red Hat Fuse 7	influxdb-java	Not affected	n/a
Red Hat Integration Camel K 1	camel-influxdb	Not affected	n/a
Red Hat Integration Camel K 1	camel-quarkus-influxdb-deployment	Not affected	n/a
Red Hat Integration Camel K 1	camel-quarkus-influxdb-integration-test	Not affected	n/a
Red Hat Integration Camel K 1	influxdb-java	Not affected	n/a
Red Hat JBoss Fuse 6	influxdb-java	Not affected	n/a
Red Hat OpenShift Container Platform 4	openshift4/ose-prometheus	Not affected	n/a

Ecosystem	Package	Introduced	Fixed
Go	github.com/influxdata/influxdb	0	1.7.6

Remediation

Red Hat mitigation

For versions before 1.7.6, as per the documentation updated by influxdb, ensure that a default shared-secret has be defined when enabling JWT authentication: https://docs.influxdata.com/influxdb/v1.8/administration/authentication_and_authorization/#1-add-a-shared-secret-in-your-influxdb-configuration-file Versions including the fix will return an error if the secret is left empty.

Weaknesses (2)

CWE-287

Improper Authentication

CWE-306

Missing Authentication

References (11)

https://access.redhat.com/security/cve/CVE-2019-20933
Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1900078
Issue Tracking
https://github.com/advisories/GHSA-2rmp-fw5r-j5qv
Advisory
https://github.com/influxdata/influxdb/commit/761b557315ff9c1642cf3b0e5797cd3d983a24c0
x_refsource_MISCPatchThird Party Advisory
https://github.com/influxdata/influxdb/compare/v1.7.5...v1.7.6
x_refsource_MISCPatchThird Party Advisory
https://github.com/influxdata/influxdb/issues/12927
x_refsource_MISCIssue TrackingThird Party Advisory
https://github.com/ticarpi/jwt_tool/blob/a6ca3e0524a204b5add070bc6874cb4e7e5a9864/jwt_tool.py#L1368
https://lists.debian.org/debian-lts-announce/2020/12/msg00030.html
mailing-listx_refsource_MLISTMailing ListThird Party Advisory
https://nvd.nist.gov/vuln/detail/CVE-2019-20933
https://www.cve.org/CVERecord?id=CVE-2019-20933
https://www.debian.org/security/2021/dsa-4823
vendor-advisoryx_refsource_DEBIANThird Party Advisory

Link	Providers	Tags
https://access.redhat.com/security/cve/CVE-2019-20933		Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1900078		Issue Tracking
https://github.com/advisories/GHSA-2rmp-fw5r-j5qv		Advisory
https://github.com/influxdata/influxdb/commit/761b557315ff9c1642cf3b0e5797cd3d983a24c0		x_refsource_MISCPatchThird Party Advisory
https://github.com/influxdata/influxdb/compare/v1.7.5...v1.7.6		x_refsource_MISCPatchThird Party Advisory
https://github.com/influxdata/influxdb/issues/12927		x_refsource_MISCIssue TrackingThird Party Advisory
https://github.com/ticarpi/jwt_tool/blob/a6ca3e0524a204b5add070bc6874cb4e7e5a9864/jwt_tool.py#L1368
https://lists.debian.org/debian-lts-announce/2020/12/msg00030.html		mailing-listx_refsource_MLISTMailing ListThird Party Advisory
https://nvd.nist.gov/vuln/detail/CVE-2019-20933
https://www.cve.org/CVERecord?id=CVE-2019-20933
https://www.debian.org/security/2021/dsa-4823		vendor-advisoryx_refsource_DEBIANThird Party Advisory