CVE-2019-1010260
Last modified
CVE-2019-1010260 is a vulnerability of currently unknown severity. Using ktlint to download and execute custom rulesets can result in arbitrary code execution as the served jars can be compromised by a MITM. This attack is exploitable via Man in the Middle of the HTTP connection to the artifact servers. EPSS estimates a 1.48% chance of exploitation in the next 30 days.
Description
Using ktlint to download and execute custom rulesets can result in arbitrary code execution as the served jars can be compromised by a MITM. This attack is exploitable via Man in the Middle of the HTTP connection to the artifact servers. This vulnerability appears to have been fixed in 0.30.0 and later; after commit 5e547b287d6c260d328a2cb658dbe6b7a7ff2261.
Metrics
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Ktlint Project | Ktlint | < 0.30.0 |
References
- https://github.com/shyiko/ktlint/pull/332Exploit, Patch, Third Party Advisory
- https://github.com/shyiko/ktlint/pull/332Exploit, Patch, Third Party Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2019-1010260?
How severe is CVE-2019-1010260?
How do I fix CVE-2019-1010260?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2019
- CVE-2019-1010250The Linux Foundation ONOS 2.0.0 and earlier is affected by: …
- CVE-2019-1010251Open Information Security Foundation Suricata prior to versi…
- CVE-2019-1010252The Linux Foundation ONOS 2.0.0 and earlier is affected by: …
- CVE-2019-1010257An Information Disclosure / Data Modification issue exists i…9.1
- CVE-2019-1010258nanosvg library nanosvg after commit c1f6e209c16b18b46aa9f45…
- CVE-2019-1010259SaltStack Salt 2018.3, 2019.2 is affected by: SQL Injection.…
- CVE-2019-1010261Gitea 1.7.0 and earlier is affected by: Cross Site Scripting…
- CVE-2019-1010262Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
- CVE-2019-1010263Perl Crypt::JWT prior to 0.023 is affected by: Incorrect Acc…
- CVE-2019-1010266lodash prior to 4.17.11 is affected by: CWE-400: Uncontrolle…6.5
- CVE-2019-1010268Ladon since 0.6.1 (since ebef0aae48af78c159b6fce81bc6f5e7e0d…
- CVE-2019-1010275helm Before 2.7.2 is affected by: CWE-295: Improper Certific…
Are you affected by CVE-2019-1010260?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST