by Kastro
Paper/Archive/CVE-2021-32700

CVE-2021-32700

ballerina-platform ballerina-lang — Supply chain attack via MiTM against users

EPSS 0.6%CVSS 9.1
critical.is priorityof 100
37
CVSS 9.1 (CNA)9.1 / 10 × 3027.3Not in CISA KEV+300.0EPSS percentile 47.7.477 × 209.5No public exploit+100.0SSVC exploitation: unknown+100.0
Description · from the CVE record

Ballerina is an open source programming language and platform for cloud application programmers. Ballerina versions 1.2.x and SL releases up to alpha 3 have a potential for a supply chain attack via MiTM against users. Http connections did not make use of TLS and certificate checking was ignored. The vulnerability allows an attacker to substitute or modify packages retrieved from BC thus allowing to inject malicious code into ballerina executables. This has been patched in Ballerina 1.2.14 and Ballerina SwanLake alpha4.

Affected

ProductAffectedFixed inSource
ballerina-lang< 1.2.14–CNA
ballerina-lang< SL-alpha4–CNA

Scores by source

GitHub_M (CNA)9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

References

refgithub.com/ballerina-platform/ballerina-lang/security/advisories/GHSA-f5qg-fqrw-v5wwrefgithub.com/ballerina-platform/ballerina-lang/commit/4609ffee1744ecd16aac09303b1783bf0a525816