CVEvulnerability
CVE-2019-11404
5.9 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2019-04-22
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.0 ([email protected])
- 8.1 HIGH — CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
- CVSS 3.0 ([email protected])
- 5.9 MEDIUM — CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
- CVSS 2.0 ([email protected])
- 4.3 MEDIUM — AV:N/AC:M/Au:N/C:P/I:N/A:N
- Weaknesses
- CWE-311
Description
arrow-kt Arrow before 0.9.0 resolved Gradle build artifacts (for compiling and building the published JARs) over HTTP instead of HTTPS. Any of these dependent artifacts could have been maliciously compromised by an MITM attack.
Affected configurations
• arrow-kt arrow (< 0.9.0)
Related
Weakness · CWE (1)
- CWE-311 Missing Encryption of Sensitive Data weakness
References
- https://github.com/arrow-kt/ank/issues/35 Exploit, Patch, Third Party Advisory
- https://github.com/arrow-kt/ank/pull/36 Patch, Third Party Advisory
- https://github.com/arrow-kt/arrow/commit/74198dab522393487d5344f194dc21208ab71ae8 Patch, Third Party Advisory
- https://github.com/arrow-kt/arrow/issues/1310 Exploit, Third Party Advisory
- https://github.com/arrow-kt/arrow/releases/tag/0.9.0 Release Notes, Third Party Advisory
- https://github.com/arrow-kt/ank/issues/35 Exploit, Patch, Third Party Advisory
- https://github.com/arrow-kt/ank/pull/36 Patch, Third Party Advisory
- https://github.com/arrow-kt/arrow/commit/74198dab522393487d5344f194dc21208ab71ae8 Patch, Third Party Advisory
- https://github.com/arrow-kt/arrow/issues/1310 Exploit, Third Party Advisory
- https://github.com/arrow-kt/arrow/releases/tag/0.9.0 Release Notes, Third Party Advisory