Description
Ballerina is an open source programming language and platform for cloud application programmers. Ballerina versions 1.2.x and SL releases up to alpha 3 have a potential for a supply chain attack via MiTM against users. Http connections did not make use of TLS and certificate checking was ignored. The vulnerability allows an attacker to substitute or modify packages retrieved from BC thus allowing to inject malicious code into ballerina executables. This has been patched in Ballerina 1.2.14 and Ballerina SwanLake alpha4.
References (2)
Core 2
Core References
Third Party Advisory x_refsource_confirm
https://github.com/ballerina-platform/ballerina-lang/security/advisories/GHSA-f5qg-fqrw-v5ww
Patch, Third Party Advisory x_refsource_misc
https://github.com/ballerina-platform/ballerina-lang/commit/4609ffee1744ecd16aac09303b1783bf0a525816
Scores
CVSS v3
9.1
EPSS
0.0058
EPSS Percentile
43.2%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Details
CWE
CWE-306
Status
published
Products (4)
ballerina/ballerina
< 1.2.14
ballerina/swan_lake
alpha1
ballerina/swan_lake
alpha2
ballerina/swan_lake
alpha3
Published
Jun 22, 2021
Tracked Since
Feb 18, 2026