CVE-2019-11404 - arrow-kt Arrow before 0.9.0 resolved Gradle build artifacts (for compiling and building the published JARs) over HTTP instead of HTTPS

Back Back to CVE browser

HIGH

arrow-kt Arrow before 0.9.0 resolved Gradle build artifacts (for compiling and building the published JARs) over HTTP instead of HTTPS

Published Apr 21, 2019

8.1

HIGH

CVSS 3.0

EPSS 1.14%

Description

arrow-kt Arrow before 0.9.0 resolved Gradle build artifacts (for compiling and building the published JARs) over HTTP instead of HTTPS. Any of these dependent artifacts could have been maliciously compromised by an MITM attack.

Affected products

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-311

Missing Encryption of Sensitive Data

References (7)

https://github.com/advisories/GHSA-rcj2-vvjx-87pm
Advisory
https://github.com/arrow-kt/ank/issues/35
x_refsource_MISCExploitPatchThird Party Advisory
https://github.com/arrow-kt/ank/pull/36
x_refsource_MISCPatchThird Party Advisory
https://github.com/arrow-kt/arrow/commit/74198dab522393487d5344f194dc21208ab71ae8
x_refsource_MISCPatchThird Party Advisory
https://github.com/arrow-kt/arrow/issues/1310
x_refsource_MISCExploitThird Party Advisory
https://github.com/arrow-kt/arrow/releases/tag/0.9.0
x_refsource_MISCRelease NotesThird Party Advisory
https://nvd.nist.gov/vuln/detail/CVE-2019-11404

Link	Providers	Tags
https://github.com/advisories/GHSA-rcj2-vvjx-87pm		Advisory
https://github.com/arrow-kt/ank/issues/35		x_refsource_MISCExploitPatchThird Party Advisory
https://github.com/arrow-kt/ank/pull/36		x_refsource_MISCPatchThird Party Advisory
https://github.com/arrow-kt/arrow/commit/74198dab522393487d5344f194dc21208ab71ae8		x_refsource_MISCPatchThird Party Advisory
https://github.com/arrow-kt/arrow/issues/1310		x_refsource_MISCExploitThird Party Advisory
https://github.com/arrow-kt/arrow/releases/tag/0.9.0		x_refsource_MISCRelease NotesThird Party Advisory
https://nvd.nist.gov/vuln/detail/CVE-2019-11404