Debian/influxdb: critical 9.8
InfluxDB before 1.7.6 has an authentication bypass vulnerability in the authenticate function in services/httpd/handler.go because a JWT token may have an empty SharedSecret (aka shared secret).
Action: Upgrade influxdb to 1.6.7~rc0-1 or later.
Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 1.6.7~rc0-1 | - |
Fixed versions
| 1.6.7~rc0-1 |
Sources
- osv: DEBIAN-CVE-2019-20933#Debian:13/influxdb
- https://security-tracker.debian.org/tracker/CVE-2019-20933
published · modified · JSON