PT-2019-12289 · Apache Arrow · Arrow-Kt

Jlleitschuh · Publicado 2019-04-21 · Atualizado 2020-08-24 · CVE-2019-11404

Positive Technologies (AI Summary)

CVSS v3.1

8.1

Alta

Vetor base

AC:H/AV:N/A:H/C:H/I:H/PR:N/S:U/UI:N

Name of the Vulnerable Software and Affected Versions arrow-kt versions prior to 0.9.0

Description The issue arises from the software resolving Gradle build artifacts over HTTP instead of HTTPS, making it susceptible to MITM attacks. This could allow malicious compromise of dependent artifacts.

Recommendations For versions prior to 0.9.0, update to version 0.9.0 or later to resolve the issue.

Exploit

Correção

Missing Encryption of Sensitive Data

Enumeração de Fraquezas

CWE-311

Identificadores relacionados

CVE-2019-11404

GHSA-RCJ2-VVJX-87PM

Produtos afetados

Arrow-Kt

Referências · 8

• 🔥 https://github.com/arrow-kt/arrow/issues/1310 · Exploit
• 🔥 https://github.com/arrow-kt/ank/issues/35 · Exploit
• https://github.com/arrow-kt/arrow/commit/74198dab522393487d5344f194dc21208ab71ae8 · Correção
• https://github.com/arrow-kt/arrow/releases/tag/0.9.0 · Nota
• https://github.com/arrow-kt/ank/pull/36 · Correção
• https://osv.dev/vulnerability/CVE-2019-11404 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2019-11404 · Nota de Segurança
• https://osv.dev/vulnerability/GHSA-rcj2-vvjx-87pm · Aviso do Fabricante