GHSA-rcj2-vvjx-87pm

Missing Encryption of Sensitive Data in arrow-kt Arrow

Source: GitHub Advisory Database (reviewed) Moderate CVE-2019-11404

Packages

Ecosystem	Package	Affected	Fixed in
Maven	io.arrow-kt:arrow-ank-gradle	< 0.9.0	0.9.0

Details

As written in the advisory (Markdown source, shown as plain text).

arrow-kt Arrow before 0.9.0 resolved Gradle build artifacts (for compiling and building the published JARs) over HTTP instead of HTTPS. Any of these dependent artifacts could have been maliciously compromised by an MITM attack.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2019-11404 advisory
https://github.com/arrow-kt/ank/issues/35 web
https://github.com/arrow-kt/arrow/issues/1310 web
https://github.com/arrow-kt/ank/pull/36 web
https://github.com/arrow-kt/arrow/commit/74198dab522393487d5344f194dc21208ab71ae8 web
https://github.com/arrow-kt/arrow/releases/tag/0.9.0 web