CVE-2021-32700

ÉLEVÉE 7.4CVE-2021-32700 · Published 22/06/2021 · updated 17/06/2026

En bref

CVE-2021-32700 est une vulnérabilité ÉLEVÉE (CVSS 7.4) touchant ballerina (ballerina), swan lake (ballerina).
Probabilité d'exploitation dans les 30 prochains jours (EPSS) : 0.58%, plus élevée que 47.9% des vulnérabilités.
Correctif : mettre à jour vers 1.2.14 ou plus récent.

Package	Affected versions	Patched versions
ballerina ballerina	`< 1.2.14`	`1.2.14`
swan lake ballerina	`= alpha1= alpha2= alpha3`	No fix yet

Description

Ballerina is an open source programming language and platform for cloud application programmers. Ballerina versions 1.2.x and SL releases up to alpha 3 have a potential for a supply chain attack via MiTM against users. Http connections did not make use of TLS and certificate checking was ignored. The vulnerability allows an attacker to substitute or modify packages retrieved from BC thus allowing to inject malicious code into ballerina executables. This has been patched in Ballerina 1.2.14 and Ballerina SwanLake alpha4.

References

ballerina-platform/ballerina-lang commit 4609ffe · Patch
ballerina-platform/ballerina-lang security advisory · Third Party Advisory

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free