CVE-2019-11404: Missing Encryption of Sensitive Data in arrow-kt Arrow
Summary
CVE-2019-11404: Missing Encryption of Sensitive Data in arrow-kt Arrow. Affects io.arrow-kt:arrow-ank-gradle versions < 0.9.0. Fixed in 0.9.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Arrow is a Kotlin library that provides functional programming constructs. It offers a set of abstractions and type classes to enable developers to write concise and expressive code. The arrow-kt Arrow library includes the arrow-ank-gradle package, which is used for compiling and building the published JARs. This vulnerability affects versions prior to 0.9.0 of Arrow.
Vulnerability Detail
The vulnerability in arrow-kt Arrow before version 0.9.0 is due to the resolution of Gradle build artifacts over HTTP instead of HTTPS. This means that when compiling and building the published JARs, the dependent artifacts could have been compromised by a Man-in-the-Middle (MITM) attack. An attacker could have intercepted the HTTP traffic and maliciously modified the artifacts, potentially leading to the execution of arbitrary code or other unauthorized actions.
How To Fix
Minimum fixed version
0.9.0
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to upgrade to the fixed version of arrow-kt Arrow to ensure the security of the project.
Conclusion
The vulnerability in arrow-kt Arrow before version 0.9.0 allows for the compromise of Gradle build artifacts over HTTP, potentially leading to the execution of arbitrary code. To mitigate this risk, it is crucial to upgrade to version 0.9.0 or later of arrow-kt Arrow. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for io.arrow-kt:arrow-ank-gradle →
FAQ
Arrow is a Kotlin library that provides functional programming constructs, enabling developers to write concise and expressive code.
This vulnerability could allow an attacker to compromise the integrity of the Gradle build artifacts used by arrow-kt Arrow, potentially leading to the execution of arbitrary code or unauthorized actions.
To fix this vulnerability, it is recommended to upgrade to version 0.9.0 or later of arrow-kt Arrow.
No, there is no known workaround for this vulnerability. Upgrading to the fixed version is necessary.
For more information about this vulnerability, you can refer to the GitHub advisory database at the provided source link.
