cve-2019-20933

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_vex",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright © Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/vex/2019/cve-2019-20933.json"
      }
    ],
    "title": "influxdb: authentication bypass because a JWT token may have an empty SharedSecret",
    "tracking": {
      "current_release_date": "2026-08-21T19:55:35+00:00",
      "generator": {
        "date": "2026-08-21T19:55:35+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "5.3.16"
        }
      },
      "id": "CVE-2019-20933",
      "initial_release_date": "2019-03-27T00:00:00+00:00",
      "revision_history": [
        {
          "date": "2019-03-27T00:00:00+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-02-02T07:28:08.904337+00:00",
          "number": "2",
          "summary": "Current version"
        },
        {
          "date": "2026-08-21T19:55:35+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Distributed Tracing Jaeger 1",
                "product": {
                  "name": "Distributed Tracing Jaeger 1",
                  "product_id": "distributed_tracing_jaeger_1",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:jaeger:1.17::el7"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Distributed Tracing Jaeger 1"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "OpenShift Service Mesh 1",
                "product": {
                  "name": "OpenShift Service Mesh 1",
                  "product_id": "openshift_service_mesh_1",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:service_mesh:1"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "OpenShift Service Mesh 1"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "OpenShift Service Mesh 2.0",
                "product": {
                  "name": "OpenShift Service Mesh 2.0",
                  "product_id": "openshift_service_mesh_2.0",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:service_mesh:2.0"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "OpenShift Service Mesh 2.0"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Advanced Cluster Management for Kubernetes 2",
                "product": {
                  "name": "Red Hat Advanced Cluster Management for Kubernetes 2",
                  "product_id": "red_hat_advanced_cluster_management_for_kubernetes_2",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:acm:2"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Advanced Cluster Management for Kubernetes 2"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Fuse 7",
                "product": {
                  "name": "Red Hat Fuse 7",
                  "product_id": "red_hat_fuse_7",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:jboss_fuse:7"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Fuse 7"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Integration Camel K 1",
                "product": {
                  "name": "Red Hat Integration Camel K 1",
                  "product_id": "red_hat_integration_camel_k_1",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:integration:1"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Integration Camel K 1"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat JBoss Fuse 6",
                "product": {
                  "name": "Red Hat JBoss Fuse 6",
                  "product_id": "red_hat_jboss_fuse_6",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:jboss_fuse:6"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat JBoss Fuse 6"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat OpenShift Container Platform 4",
                "product": {
                  "name": "Red Hat OpenShift Container Platform 4",
                  "product_id": "red_hat_openshift_container_platform_4",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:openshift:4"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat OpenShift Container Platform 4"
          },
          {
            "category": "product_version",
            "name": "jaeger-rhel8-operator.src",
            "product": {
              "name": "jaeger-rhel8-operator.src",
              "product_id": "jaeger-rhel8-operator.src",
              "product_identification_helper": {
                "purl": "pkg:rpm/redhat/jaeger-rhel8-operator?arch=src"
              }
            }
          },
          {
            "category": "product_version",
            "name": "servicemesh-prometheus.src",
            "product": {
              "name": "servicemesh-prometheus.src",
              "product_id": "servicemesh-prometheus.src",
              "product_identification_helper": {
                "purl": "pkg:rpm/redhat/servicemesh-prometheus?arch=src"
              }
            }
          },
          {
            "category": "product_version",
            "name": "servicemesh-prometheus",
            "product": {
              "name": "servicemesh-prometheus",
              "product_id": "servicemesh-prometheus",
              "product_identification_helper": {
                "purl": "pkg:rpm/redhat/servicemesh-prometheus"
              }
            }
          },
          {
            "category": "product_version",
            "name": "influxdb.src",
            "product": {
              "name": "influxdb.src",
              "product_id": "influxdb.src",
              "product_identification_helper": {
                "purl": "pkg:rpm/redhat/influxdb?arch=src"
              }
            }
          },
          {
            "category": "product_version",
            "name": "camel-influxdb",
            "product": {
              "name": "camel-influxdb",
              "product_id": "camel-influxdb"
            }
          },
          {
            "category": "product_version",
            "name": "camel-influxdb-starter",
            "product": {
              "name": "camel-influxdb-starter",
              "product_id": "camel-influxdb-starter"
            }
          },
          {
            "category": "product_version",
            "name": "influxdb-java",
            "product": {
              "name": "influxdb-java",
              "product_id": "influxdb-java"
            }
          },
          {
            "category": "product_version",
            "name": "camel-quarkus-influxdb-deployment",
            "product": {
              "name": "camel-quarkus-influxdb-deployment",
              "product_id": "camel-quarkus-influxdb-deployment"
            }
          },
          {
            "category": "product_version",
            "name": "camel-quarkus-influxdb-integration-test",
            "product": {
              "name": "camel-quarkus-influxdb-integration-test",
              "product_id": "camel-quarkus-influxdb-integration-test"
            }
          },
          {
            "category": "product_version",
            "name": "openshift4/ose-prometheus",
            "product": {
              "name": "openshift4/ose-prometheus",
              "product_id": "openshift4/ose-prometheus",
              "product_identification_helper": {
                "purl": "pkg:oci/ose-prometheus-rhel9?repository_url=registry.redhat.io/openshift4/ose-prometheus-rhel9"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jaeger-rhel8-operator.src as a component of Distributed Tracing Jaeger 1",
          "product_id": "distributed_tracing_jaeger_1:jaeger-rhel8-operator.src"
        },
        "product_reference": "jaeger-rhel8-operator.src",
        "relates_to_product_reference": "distributed_tracing_jaeger_1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "servicemesh-prometheus as a component of OpenShift Service Mesh 1",
          "product_id": "openshift_service_mesh_1:servicemesh-prometheus"
        },
        "product_reference": "servicemesh-prometheus",
        "relates_to_product_reference": "openshift_service_mesh_1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "servicemesh-prometheus.src as a component of OpenShift Service Mesh 1",
          "product_id": "openshift_service_mesh_1:servicemesh-prometheus.src"
        },
        "product_reference": "servicemesh-prometheus.src",
        "relates_to_product_reference": "openshift_service_mesh_1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "servicemesh-prometheus as a component of OpenShift Service Mesh 2.0",
          "product_id": "openshift_service_mesh_2.0:servicemesh-prometheus"
        },
        "product_reference": "servicemesh-prometheus",
        "relates_to_product_reference": "openshift_service_mesh_2.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "servicemesh-prometheus.src as a component of OpenShift Service Mesh 2.0",
          "product_id": "openshift_service_mesh_2.0:servicemesh-prometheus.src"
        },
        "product_reference": "servicemesh-prometheus.src",
        "relates_to_product_reference": "openshift_service_mesh_2.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "influxdb.src as a component of Red Hat Advanced Cluster Management for Kubernetes 2",
          "product_id": "red_hat_advanced_cluster_management_for_kubernetes_2:influxdb.src"
        },
        "product_reference": "influxdb.src",
        "relates_to_product_reference": "red_hat_advanced_cluster_management_for_kubernetes_2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "camel-influxdb as a component of Red Hat Fuse 7",
          "product_id": "red_hat_fuse_7:camel-influxdb"
        },
        "product_reference": "camel-influxdb",
        "relates_to_product_reference": "red_hat_fuse_7"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "camel-influxdb-starter as a component of Red Hat Fuse 7",
          "product_id": "red_hat_fuse_7:camel-influxdb-starter"
        },
        "product_reference": "camel-influxdb-starter",
        "relates_to_product_reference": "red_hat_fuse_7"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "influxdb-java as a component of Red Hat Fuse 7",
          "product_id": "red_hat_fuse_7:influxdb-java"
        },
        "product_reference": "influxdb-java",
        "relates_to_product_reference": "red_hat_fuse_7"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "camel-influxdb as a component of Red Hat Integration Camel K 1",
          "product_id": "red_hat_integration_camel_k_1:camel-influxdb"
        },
        "product_reference": "camel-influxdb",
        "relates_to_product_reference": "red_hat_integration_camel_k_1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "camel-quarkus-influxdb-deployment as a component of Red Hat Integration Camel K 1",
          "product_id": "red_hat_integration_camel_k_1:camel-quarkus-influxdb-deployment"
        },
        "product_reference": "camel-quarkus-influxdb-deployment",
        "relates_to_product_reference": "red_hat_integration_camel_k_1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "camel-quarkus-influxdb-integration-test as a component of Red Hat Integration Camel K 1",
          "product_id": "red_hat_integration_camel_k_1:camel-quarkus-influxdb-integration-test"
        },
        "product_reference": "camel-quarkus-influxdb-integration-test",
        "relates_to_product_reference": "red_hat_integration_camel_k_1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "influxdb-java as a component of Red Hat Integration Camel K 1",
          "product_id": "red_hat_integration_camel_k_1:influxdb-java"
        },
        "product_reference": "influxdb-java",
        "relates_to_product_reference": "red_hat_integration_camel_k_1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "influxdb-java as a component of Red Hat JBoss Fuse 6",
          "product_id": "red_hat_jboss_fuse_6:influxdb-java"
        },
        "product_reference": "influxdb-java",
        "relates_to_product_reference": "red_hat_jboss_fuse_6"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openshift4/ose-prometheus as a component of Red Hat OpenShift Container Platform 4",
          "product_id": "red_hat_openshift_container_platform_4:openshift4/ose-prometheus"
        },
        "product_reference": "openshift4/ose-prometheus",
        "relates_to_product_reference": "red_hat_openshift_container_platform_4"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2019-20933",
      "cwe": {
        "id": "CWE-306",
        "name": "Missing Authentication for Critical Function"
      },
      "discovery_date": "2020-11-19T00:00:00+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "distributed_tracing_jaeger_1:jaeger-rhel8-operator.src",
            "openshift_service_mesh_1:servicemesh-prometheus",
            "openshift_service_mesh_1:servicemesh-prometheus.src",
            "openshift_service_mesh_2.0:servicemesh-prometheus",
            "openshift_service_mesh_2.0:servicemesh-prometheus.src",
            "red_hat_advanced_cluster_management_for_kubernetes_2:influxdb.src",
            "red_hat_fuse_7:camel-influxdb",
            "red_hat_fuse_7:camel-influxdb-starter",
            "red_hat_fuse_7:influxdb-java",
            "red_hat_integration_camel_k_1:camel-influxdb",
            "red_hat_integration_camel_k_1:camel-quarkus-influxdb-deployment",
            "red_hat_integration_camel_k_1:camel-quarkus-influxdb-integration-test",
            "red_hat_integration_camel_k_1:influxdb-java",
            "red_hat_jboss_fuse_6:influxdb-java",
            "red_hat_openshift_container_platform_4:openshift4/ose-prometheus"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1900078"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "An authentication bypass vulnerability was found in InfluxDB. By default, when using JWT authentication, InfluxDB does not generate a signing secret or state in the documentation that a JWT secret must be generated. If InfluxDB is left in the default state, this flaw allows an attacker to generate their own JWT token and log into the InfluxDBinstance, potentially escalating privileges and gaining access to sensitive information.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "influxdb: authentication bypass because a JWT token may have an empty SharedSecret",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "known_not_affected": [
          "distributed_tracing_jaeger_1:jaeger-rhel8-operator.src",
          "openshift_service_mesh_1:servicemesh-prometheus",
          "openshift_service_mesh_1:servicemesh-prometheus.src",
          "openshift_service_mesh_2.0:servicemesh-prometheus",
          "openshift_service_mesh_2.0:servicemesh-prometheus.src",
          "red_hat_advanced_cluster_management_for_kubernetes_2:influxdb.src",
          "red_hat_fuse_7:camel-influxdb",
          "red_hat_fuse_7:camel-influxdb-starter",
          "red_hat_fuse_7:influxdb-java",
          "red_hat_integration_camel_k_1:camel-influxdb",
          "red_hat_integration_camel_k_1:camel-quarkus-influxdb-deployment",
          "red_hat_integration_camel_k_1:camel-quarkus-influxdb-integration-test",
          "red_hat_integration_camel_k_1:influxdb-java",
          "red_hat_jboss_fuse_6:influxdb-java",
          "red_hat_openshift_container_platform_4:openshift4/ose-prometheus"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2019-20933"
        },
        {
          "category": "external",
          "summary": "RHBZ#1900078",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1900078"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2019-20933",
          "url": "https://www.cve.org/CVERecord?id=CVE-2019-20933"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-20933",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-20933"
        },
        {
          "category": "external",
          "summary": "https://github.com/influxdata/influxdb/issues/12927",
          "url": "https://github.com/influxdata/influxdb/issues/12927"
        }
      ],
      "release_date": "2019-03-27T00:00:00+00:00",
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 8.6,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L",
            "version": "3.1"
          },
          "products": [
            "distributed_tracing_jaeger_1:jaeger-rhel8-operator.src",
            "openshift_service_mesh_1:servicemesh-prometheus",
            "openshift_service_mesh_1:servicemesh-prometheus.src",
            "openshift_service_mesh_2.0:servicemesh-prometheus",
            "openshift_service_mesh_2.0:servicemesh-prometheus.src",
            "red_hat_advanced_cluster_management_for_kubernetes_2:influxdb.src",
            "red_hat_fuse_7:camel-influxdb",
            "red_hat_fuse_7:camel-influxdb-starter",
            "red_hat_fuse_7:influxdb-java",
            "red_hat_integration_camel_k_1:camel-influxdb",
            "red_hat_integration_camel_k_1:camel-quarkus-influxdb-deployment",
            "red_hat_integration_camel_k_1:camel-quarkus-influxdb-integration-test",
            "red_hat_integration_camel_k_1:influxdb-java",
            "red_hat_jboss_fuse_6:influxdb-java",
            "red_hat_openshift_container_platform_4:openshift4/ose-prometheus"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important",
          "product_ids": [
            "distributed_tracing_jaeger_1:jaeger-rhel8-operator.src",
            "openshift_service_mesh_1:servicemesh-prometheus",
            "openshift_service_mesh_1:servicemesh-prometheus.src",
            "openshift_service_mesh_2.0:servicemesh-prometheus",
            "openshift_service_mesh_2.0:servicemesh-prometheus.src",
            "red_hat_advanced_cluster_management_for_kubernetes_2:influxdb.src",
            "red_hat_fuse_7:camel-influxdb",
            "red_hat_fuse_7:camel-influxdb-starter",
            "red_hat_fuse_7:influxdb-java",
            "red_hat_integration_camel_k_1:camel-influxdb",
            "red_hat_integration_camel_k_1:camel-quarkus-influxdb-deployment",
            "red_hat_integration_camel_k_1:camel-quarkus-influxdb-integration-test",
            "red_hat_integration_camel_k_1:influxdb-java",
            "red_hat_jboss_fuse_6:influxdb-java",
            "red_hat_openshift_container_platform_4:openshift4/ose-prometheus"
          ]
        }
      ],
      "title": "influxdb: authentication bypass because a JWT token may have an empty SharedSecret"
    }
  ]
}