GHSA-mc84-xr9p-938r

Suggest an improvement
Source
https://github.com/advisories/GHSA-mc84-xr9p-938r
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2019/09/GHSA-mc84-xr9p-938r/GHSA-mc84-xr9p-938r.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-mc84-xr9p-938r
Published
2019-09-23T18:31:05Z
Modified
2021-09-15T18:50:22Z
Severity
  • 8.1 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
High severity vulnerability that affects generator-jhipster
Details

Generated code uses repository configuration that downloads over HTTP instead of HTTPS

Impact

Gradle users were using the http://repo.spring.io/plugins-release repositories in plain HTTP, and not HTTPS, so a man-in-the-middle attack was possible at build time.

Patches

Maven users should at least upgrade to 6.3.0 while Gradle users should update to 6.3.1. If you are not able to upgrade make sure not to use a Maven repository via http in your build file.

Workarounds

Replace all custom repository definitions in build.gradle or pom.xml with their https version.

e.g.

 <repository>
            <id>oss.sonatype.org-snapshot</id>
            <url>https://oss.sonatype.org/content/repositories/snapshots</url> // <-- must be httpS
            <releases>
                <enabled>false</enabled>
            </releases>
            <snapshots>
                <enabled>true</enabled>
            </snapshots>
</repository>

maven { url "https://repo.spring.io/plugins-release" } // <-- must be httpS

References

For more information

If you have any questions or comments about this advisory:

Database specific 
{
    "cwe_ids":  [
        "CWE-494",
        "CWE-829"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2020-06-16T21:45:50Z",
    "nvd_published_at":  null,
    "severity":  "HIGH"
}
References

Affected packages

npm / generator-jhipster

Package

Name
generator-jhipster
View open source insights on deps.dev
Purl
pkg:npm/generator-jhipster

Affected ranges

Type
SEMVER
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
6.3.1

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2019/09/GHSA-mc84-xr9p-938r/GHSA-mc84-xr9p-938r.json"