PT-2019-12289 · Apache Arrow · Arrow-Kt

Jlleitschuh · Published 2019-04-21 · Updated 2020-08-24 · CVE-2019-11404

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AC:H/AV:N/A:H/C:H/I:H/PR:N/S:U/UI:N

Name of the Vulnerable Software and Affected Versions arrow-kt versions prior to 0.9.0

Description The issue arises from the software resolving Gradle build artifacts over HTTP instead of HTTPS, making it susceptible to MITM attacks. This could allow malicious compromise of dependent artifacts.

Recommendations For versions prior to 0.9.0, update to version 0.9.0 or later to resolve the issue.

Exploit

Fix

Missing Encryption of Sensitive Data

Weakness Enumeration

CWE-311

Related Identifiers

CVE-2019-11404

GHSA-RCJ2-VVJX-87PM

Affected Products

Arrow-Kt

References · 8

• 🔥 https://github.com/arrow-kt/arrow/issues/1310 · Exploit
• 🔥 https://github.com/arrow-kt/ank/issues/35 · Exploit
• https://github.com/arrow-kt/arrow/commit/74198dab522393487d5344f194dc21208ab71ae8 · Patch
• https://github.com/arrow-kt/ank/pull/36 · Patch
• https://osv.dev/vulnerability/CVE-2019-11404 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-11404 · Security Note
• https://osv.dev/vulnerability/GHSA-rcj2-vvjx-87pm · Vendor Advisory
• https://github.com/arrow-kt/arrow/releases/tag/0.9.0 · Note