1. CVE-Search
  2. CVE-2019-19879
ID CVE-2019-19879
Summary HashiCorp Sentinel up to 0.10.1 incorrectly parsed negation in certain policy expressions. Fixed in 0.10.2.
References
Vulnerable Configurations
  • cpe:2.3:a:hashicorp:sentinel:0.1.0:*:*:*:*:*:*:*
    cpe:2.3:a:hashicorp:sentinel:0.1.0:*:*:*:*:*:*:*
  • cpe:2.3:a:hashicorp:sentinel:0.2.0:*:*:*:*:*:*:*
    cpe:2.3:a:hashicorp:sentinel:0.2.0:*:*:*:*:*:*:*
  • cpe:2.3:a:hashicorp:sentinel:0.3.0:*:*:*:*:*:*:*
    cpe:2.3:a:hashicorp:sentinel:0.3.0:*:*:*:*:*:*:*
  • cpe:2.3:a:hashicorp:sentinel:0.3.1:*:*:*:*:*:*:*
    cpe:2.3:a:hashicorp:sentinel:0.3.1:*:*:*:*:*:*:*
  • cpe:2.3:a:hashicorp:sentinel:0.3.2:*:*:*:*:*:*:*
    cpe:2.3:a:hashicorp:sentinel:0.3.2:*:*:*:*:*:*:*
  • cpe:2.3:a:hashicorp:sentinel:0.4.0:*:*:*:*:*:*:*
    cpe:2.3:a:hashicorp:sentinel:0.4.0:*:*:*:*:*:*:*
  • cpe:2.3:a:hashicorp:sentinel:0.5.0:*:*:*:*:*:*:*
    cpe:2.3:a:hashicorp:sentinel:0.5.0:*:*:*:*:*:*:*
  • cpe:2.3:a:hashicorp:sentinel:0.5.1:*:*:*:*:*:*:*
    cpe:2.3:a:hashicorp:sentinel:0.5.1:*:*:*:*:*:*:*
  • cpe:2.3:a:hashicorp:sentinel:0.6.0:*:*:*:*:*:*:*
    cpe:2.3:a:hashicorp:sentinel:0.6.0:*:*:*:*:*:*:*
  • cpe:2.3:a:hashicorp:sentinel:0.7.0:*:*:*:*:*:*:*
    cpe:2.3:a:hashicorp:sentinel:0.7.0:*:*:*:*:*:*:*
  • cpe:2.3:a:hashicorp:sentinel:0.8.0:*:*:*:*:*:*:*
    cpe:2.3:a:hashicorp:sentinel:0.8.0:*:*:*:*:*:*:*
  • cpe:2.3:a:hashicorp:sentinel:0.8.1:*:*:*:*:*:*:*
    cpe:2.3:a:hashicorp:sentinel:0.8.1:*:*:*:*:*:*:*
  • cpe:2.3:a:hashicorp:sentinel:0.9.0:*:*:*:*:*:*:*
    cpe:2.3:a:hashicorp:sentinel:0.9.0:*:*:*:*:*:*:*
  • cpe:2.3:a:hashicorp:sentinel:0.9.1:*:*:*:*:*:*:*
    cpe:2.3:a:hashicorp:sentinel:0.9.1:*:*:*:*:*:*:*
  • cpe:2.3:a:hashicorp:sentinel:0.9.2:*:*:*:*:*:*:*
    cpe:2.3:a:hashicorp:sentinel:0.9.2:*:*:*:*:*:*:*
  • cpe:2.3:a:hashicorp:sentinel:0.10.0:*:*:*:*:*:*:*
    cpe:2.3:a:hashicorp:sentinel:0.10.0:*:*:*:*:*:*:*
  • cpe:2.3:a:hashicorp:sentinel:0.10.1:*:*:*:*:*:*:*
    cpe:2.3:a:hashicorp:sentinel:0.10.1:*:*:*:*:*:*:*
CVSS
Base: 5.0 (as of 25-02-2020 - 17:40)
Impact:
Exploitability:
CWE NVD-CWE-noinfo
CAPEC
Access
VectorComplexityAuthentication
NETWORK LOW NONE
Impact
ConfidentialityIntegrityAvailability
NONE PARTIAL NONE
cvss-vector via4 AV:N/AC:L/Au:N/C:N/I:P/A:N
refmap via4
misc https://discuss.hashicorp.com/t/security-bulletin-sentinel-incorrectly-parses-negation-in-certain-policy-expressions/5955
Last major update 25-02-2020 - 17:40
Published 14-02-2020 - 17:15
Last modified 25-02-2020 - 17:40
Back to Top