PT-2021-19866 · Ballerina · Ballerina

Published 2021-06-22 · Updated 2021-06-29 · CVE-2021-32700

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Ballerina versions 1.2.x through 1.2.13 Ballerina SL releases up to alpha 3

Description Ballerina is an open source programming language and platform for cloud application programmers. The issue allows for a supply chain attack via Man-in-the-Middle (MiTM) against users. HTTP connections did not utilize TLS and certificate checking was ignored, enabling an attacker to substitute or modify packages retrieved from BC, thus allowing the injection of malicious code into Ballerina executables.

Recommendations For Ballerina versions 1.2.x through 1.2.13, update to Ballerina 1.2.14 to resolve the issue. For Ballerina SL releases up to alpha 3, update to Ballerina SwanLake alpha4 to resolve the issue.

Fix

Missing Authentication

Weakness Enumeration

CWE-306

Related Identifiers

CVE-2021-32700

GHSA-F5QG-FQRW-V5WW

Affected Products

Ballerina

References · 7

• https://github.com/ballerina-platform/ballerina-lang/commit/4609ffee1744ecd16aac09303b1783bf0a525816 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2021-32700 · Security Note
• https://osv.dev/vulnerability/CVE-2021-32700 · Vendor Advisory
• https://github.com/ballerina-platform/ballerina-lang/security/advisories/GHSA-f5qg-fqrw-v5ww · Note
• https://t.me/cvenotify/16845 · Telegram Post
• https://t.me/cvenotify/16705 · Telegram Post
• https://t.me/cibsecurity/25626 · Telegram Post