CVE-2019-11404

Опубликовано: 22 апр. 2019

Источник: nvd

CVSS3: 8.1

CVSS3: 5.9

CVSS2: 4.3

EPSS Низкий

Описание

arrow-kt Arrow before 0.9.0 resolved Gradle build artifacts (for compiling and building the published JARs) over HTTP instead of HTTPS. Any of these dependent artifacts could have been maliciously compromised by an MITM attack.

Ссылки

https://github.com/arrow-kt/ank/issues/35
Exploit
Patch
Third Party Advisory
https://github.com/arrow-kt/ank/pull/36
Patch
Third Party Advisory
https://github.com/arrow-kt/arrow/commit/74198dab522393487d5344f194dc21208ab71ae8
Patch
Third Party Advisory
https://github.com/arrow-kt/arrow/issues/1310
Exploit
Third Party Advisory
https://github.com/arrow-kt/arrow/releases/tag/0.9.0
Release Notes
Third Party Advisory
https://github.com/arrow-kt/ank/issues/35
Exploit
Patch
Third Party Advisory
https://github.com/arrow-kt/ank/pull/36
Patch
Third Party Advisory
https://github.com/arrow-kt/arrow/commit/74198dab522393487d5344f194dc21208ab71ae8
Patch
Third Party Advisory
https://github.com/arrow-kt/arrow/issues/1310
Exploit
Third Party Advisory
https://github.com/arrow-kt/arrow/releases/tag/0.9.0
Release Notes
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:arrow-kt:arrow:*:*:*:*:*:*:*:*

Версия до 0.9.0 (исключая)

EPSS

Процентиль: 55%

0.00319

Низкий

8.1 High

CVSS3

5.9 Medium

CVSS3

4.3 Medium

CVSS2

Дефекты

CWE-311

Связанные уязвимости

GHSA-rcj2-vvjx-87pm

CVSS3: 5.9

github

почти 7 лет назад

Missing Encryption of Sensitive Data in arrow-kt Arrow

EPSS

Процентиль: 55%

0.00319

Низкий

8.1 High

CVSS3

5.9 Medium

CVSS3

4.3 Medium

CVSS2

Дефекты

CWE-311