EUVD-2019-0433

Malware in sbrugna...

High severity vulnerability that affects com.github.shyiko.ktlint:ktlint-core

Using ktlint to download and execute custom rulesets can result in arbitrary code execution as the served jars can be compromised by a MITM. This attack is exploitable via Man in the Middle of the HTTP connection to the artifact servers. This vulnerability appears to have been fixed in 0.30.0 and...

com.gabrielittner.ktlint:ktlint-rules (0.1.0), com.github.gantsign.maven:ktlint-maven-plugin (>=0.9.8, <=0.9.17) +15 more potentially affected by CVE-2019-1010260 via com.github.shyiko.ktlint:ktlint-core (>=0.2.0, <=0.29.0)

com.github.shyiko.ktlint:ktlint-core MAVEN version =0.2.0, =0.9.8, =0.9.0, =0.9.0, =0.9.0, =0.2.0, =0.2.0, =0.2.0, =0.6.0, =0.8.5, =0.8.5, =1.0.0.rc7-3, =1.0.0.rc7-3, =1.0.0-gradle-rework-beta3 and more Source cves: CVE-2019-1010260 Source advisory: OSV:GHSA-R8H9-HQ9C-2P5C...

com.gabrielittner.ktlint:ktlint-rules (0.1.0), com.github.gantsign.maven:ktlint-maven-plugin (>=0.9.8, <=0.9.17) +15 more potentially affected by CVE-2019-1010260 via com.github.shyiko.ktlint:ktlint-core (>=0.2.0, <=0.29.0)

com.github.shyiko.ktlint:ktlint-core MAVEN version =0.2.0, =0.9.8, =0.9.0, =0.9.0, =0.9.0, =0.2.0, =0.2.0, =0.2.0, =0.6.0, =0.8.5, =0.8.5, =1.0.0.rc7-3, =1.0.0.rc7-3, =1.0.0-gradle-rework-beta3 and more Source cves: CVE-2019-1010260 Source advisory: GHSA-R8H9-HQ9C-2P5C...

GHSA-R8H9-HQ9C-2P5C High severity vulnerability that affects com.github.shyiko.ktlint:ktlint-core

Using ktlint to download and execute custom rulesets can result in arbitrary code execution as the served jars can be compromised by a MITM. This attack is exploitable via Man in the Middle of the HTTP connection to the artifact servers. This vulnerability appears to have been fixed in 0.30.0 and...

CVE-2019-1010260

Using ktlint to download and execute custom rulesets can result in arbitrary code execution as the served jars can be compromised by a MITM. This attack is exploitable via Man in the Middle of the HTTP connection to the artifact servers. This vulnerability appears to have been fixed in 0.30.0 and...

CVE-2019-1010260

Using ktlint to download and execute custom rulesets can result in arbitrary code execution as the served jars can be compromised by a MITM. This attack is exploitable via Man in the Middle of the HTTP connection to the artifact servers. This vulnerability appears to have been fixed in 0.30.0 and...

Code injection

Using ktlint to download and execute custom rulesets can result in arbitrary code execution as the served jars can be compromised by a MITM. This attack is exploitable via Man in the Middle of the HTTP connection to the artifact servers. This vulnerability appears to have been fixed in 0.30.0 and...

CVE-2019-1010260

Using ktlint to download and execute custom rulesets can result in arbitrary code execution as the served jars can be compromised by a MITM. This attack is exploitable via Man in the Middle of the HTTP connection to the artifact servers. This vulnerability appears to have been fixed in 0.30.0 and...

CVE-2019-1010260

Using ktlint to download and execute custom rulesets can result in arbitrary code execution as the served jars can be compromised by a MITM. This attack is exploitable via Man in the Middle of the HTTP connection to the artifact servers. This vulnerability appears to have been fixed in 0.30.0 and...

com.gabrielittner.ktlint:ktlint-rules (0.1.0), com.github.gantsign.maven:ktlint-maven-plugin (>=0.9.8, <=0.9.17) +15 more potentially affected by CVE-2019-1010260 via com.github.shyiko.ktlint:ktlint-core (>=0.2.0, <=0.29.0)

com.github.shyiko.ktlint:ktlint-core MAVEN version =0.2.0, =0.9.8, =0.9.0, =0.9.0, =0.9.0, =0.2.0, =0.2.0, =0.2.0, =0.6.0, =0.8.5, =0.8.5, =1.0.0.rc7-3, =1.0.0.rc7-3, =1.0.0-gradle-rework-beta3 and more Source cves: CVE-2019-1010260 Source advisory: MEND:CVE-2019-1010260...

CVE-2019-1010260

The connected documents confirm a vulnerability in com.github.shyiko.ktlint:ktlint-core where downloading and executing custom rulesets over HTTP can be compromised via a MITM, allowing arbitrary code execution. The issue arises from serving jars that can be tampered, enabling exploitation during...

CVE-2019-1010260: Cleartext Transmission of Sensitive Information

Using ktlint to download and execute custom rulesets can result in arbitrary code execution as the served jars can be compromised by a MITM. This attack is exploitable via Man in the Middle of the HTTP connection to the artifact servers. This vulnerability appears to have been fixed in 0.30.0 and...

PT-2019-11533

Name of the Vulnerable Software and Affected Versions: ktlint versions prior to 0.30.0 Description: The issue allows for arbitrary code execution when using ktlint to download and execute custom rulesets, as the served jars can be compromised by a Man in the Middle MITM attack. This attack is...