CVE-2019-11404
Missing Encryption of Sensitive Data in arrow-kt Arrow
5.9
MEDIUM
CVSS 3.1
EPSS 0.31%
Description
arrow-kt Arrow before 0.9.0 resolved Gradle build artifacts (for compiling and building the published JARs) over HTTP instead of HTTPS. Any of these dependent artifacts could have been maliciously compromised by an MITM attack.
How to fix CVE-2019-11404
To remediate CVE-2019-11404, upgrade the affected package to a fixed version below.
- —upgrade to 0.9.0 or later
Is CVE-2019-11404 being exploited?
Low — EPSS is 0.3%, meaning exploitation activity has not been observed at scale.
Affected packages (1)
- from 0, < 0.9.0
CVSS scores
| Source | Version | Severity | Vector |
|---|---|---|---|
| osv | CVSS 3.1 | MEDIUM5.9 | CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N |