InfluxDB before 1.7.6 has an authentication bypass vulnerability in the authenticate function in services/httpd/handler.go because a JWT token may have an empty SharedSecret (aka shared secret).

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - InfluxDB before 1.7.6 has an authentication bypass vulnerability in the authenticate function in
    services/httpd/handler.go because a JWT token may have an empty SharedSecret (aka shared secret).
    (CVE-2019-20933)

An update of the kapacitor package has been released.

The remote Ubuntu 18.04 LTS / 20.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-5451-1 advisory.

    Ilya Averyanov discovered that an InfluxDB vulnerability allowed attackers to bypass authentication and     gain access to any known database user.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

An update of the influxdb package has been released.

It was discovered that incorrect validation of JWT tokens in InfluxDB, a time series, metrics, and analytics database, could result in authentication bypass.

An issue has been found in influxdb, a scalable datastore for metrics, events, and real-time analytics. By using a JWT token with an empty shared secret, one is able to bypass authentication in services/httpd/handler.go.

For Debian 9 stretch, this problem has been fixed in version 1.1.1+dfsg1-4+deb9u1.

We recommend that you upgrade your influxdb packages.

For the detailed security status of influxdb please refer to its security tracker page at:
https://security-tracker.debian.org/tracker/influxdb

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
409080	SCA: security update for github.com/influxdata/influxdb (GHSA-2rmp-fw5r-j5qv)	Tenable Cloud Security	SCA Checks	critical
409080	SCA: security update for github.com/influxdata/influxdb (GHSA-2rmp-fw5r-j5qv)	Tenable Self-Hosted Container Security	SCA Checks	critical
204224	Photon OS 5.0: Kapacitor PHSA-2023-5.0-0045	Nessus	PhotonOS Local Security Checks	critical
161724	Ubuntu 18.04 LTS / 20.04 LTS : InfluxDB vulnerability (USN-5451-1)	Nessus	Ubuntu Local Security Checks	critical
144894	Photon OS 2.0: Influxdb PHSA-2021-2.0-0308	Nessus	PhotonOS Local Security Checks	critical
144679	Debian DSA-4823-1 : influxdb - security update	Nessus	Debian Local Security Checks	critical
144490	Debian DLA-2501-1 : influxdb security update	Nessus	Debian Local Security Checks	critical
144067	Photon OS 3.0: Influxdb PHSA-2020-3.0-0172	Nessus	PhotonOS Local Security Checks	critical

Detections

Analytics

CVE-2019-20933

critical

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical

critical