CVE-2019-10102

JetBrains Ktor framework (created using the Kotlin IDE template) versions before 1.1.0 were resolving artifacts using an http connection during the build process, potentially allowing an MITM attack. This issue was fixed in Kotlin plugin version 1.3.30.

Weakness

The product transmits sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors.

Affected Software

Potential Mitigations

Related Attack Patterns

• https://cwe.mitre.org/data/definitions/102.html
• https://cwe.mitre.org/data/definitions/117.html
• https://cwe.mitre.org/data/definitions/383.html
• https://cwe.mitre.org/data/definitions/477.html
• https://cwe.mitre.org/data/definitions/65.html

References

• https://blog.jetbrains.com/blog/2019/06/19/jetbrains-security-bulletin-q1-2019/
• https://security.netapp.com/advisory/ntap-20230818-0012/
• https://blog.jetbrains.com/blog/2019/06/19/jetbrains-security-bulletin-q1-2019/
• https://security.netapp.com/advisory/ntap-20230818-0012/