GitHub Advisoryadvisory · Maven
GHSA-rcj2-vvjx-87pm Missing Encryption of Sensitive Data in arrow-kt Arrow
MEDIUM
Official page ↗
- Aliases
- CVE-2019-11404
- Ecosystem
- Maven
- Packages
- io.arrow-kt:arrow-ank-gradle
- Severity
- Moderate
- CVSS vector
- CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
- Weaknesses
- CWE-311
- Reviewed
- 2019-04-22
Affected packages
• Maven io.arrow-kt:arrow-ank-gradle: < 0.9.0 → fixed in 0.9.0
Description
arrow-kt Arrow before 0.9.0 resolved Gradle build artifacts (for compiling and building the published JARs) over HTTP instead of HTTPS. Any of these dependent artifacts could have been maliciously compromised by an MITM attack.
Related
Alias · CVE (1)
- CVE-2019-11404 arrow-kt Arrow before 0.9.0 resolved Gradle build artifacts (for compiling and building the published JARs) over HTTP instead of HTTPS. vulnerability
Weakness · CWE (1)
- CWE-311 Missing Encryption of Sensitive Data weakness
References
- https://nvd.nist.gov/vuln/detail/CVE-2019-11404 advisory
- https://github.com/arrow-kt/ank/issues/35 web
- https://github.com/arrow-kt/arrow/issues/1310 web
- https://github.com/arrow-kt/ank/pull/36 web
- https://github.com/arrow-kt/arrow/commit/74198dab522393487d5344f194dc21208ab71ae8 web
- https://github.com/arrow-kt/arrow/releases/tag/0.9.0 web