Ecosyste.ms: Advisories

Security Advisories: MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLXJjajItdnZqeC04N3Bt

Missing Encryption of Sensitive Data in arrow-kt Arrow

arrow-kt Arrow before 0.9.0 resolved Gradle build artifacts (for compiling and building the published JARs) over HTTP instead of HTTPS. Any of these dependent artifacts could have been maliciously compromised by an MITM attack.

Permalink: https://github.com/advisories/GHSA-rcj2-vvjx-87pm
JSON: https://advisories.ecosyste.ms/api/v1/advisories/MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLXJjajItdnZqeC04N3Bt
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Moderate
Classification: General
Published: over 5 years ago
Updated: almost 2 years ago

CVSS Score: 5.9
CVSS vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS Percentage: 0.00198
EPSS Percentile: 0.585

Identifiers: GHSA-rcj2-vvjx-87pm, CVE-2019-11404
References:

• https://nvd.nist.gov/vuln/detail/CVE-2019-11404
• https://github.com/arrow-kt/ank/issues/35
• https://github.com/arrow-kt/ank/pull/36
• https://github.com/arrow-kt/arrow/commit/74198dab522393487d5344f194dc21208ab71ae8
• https://github.com/arrow-kt/arrow/issues/1310
• https://github.com/arrow-kt/arrow/releases/tag/0.9.0
• https://github.com/advisories/GHSA-rcj2-vvjx-87pm

Repository: https://github.com/arrow-kt/ank
Blast Radius: 0.0

Affected Packages