Supply chain attack via MiTM against users
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · High · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-306.
Summary
Ballerina is an open source programming language and platform for cloud application programmers. Ballerina versions 1.2.x and SL releases up to alpha 3 have a potential for a supply chain attack via MiTM against users. Http connections did not make use of TLS and certificate checking was ignored. The vulnerability allows an attacker to substitute or modify packages retrieved from BC thus allowing to inject malicious code into ballerina executables. This has been patched in Ballerina 1.2.14 and Ballerina SwanLake alpha4.
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| ballerina-platform | ballerina-lang | before 1.2.14; < SL-alpha4 | 1.2.14 | Patch available | CNA |
- ballerina-lang Vendorballerina-platform Affected before 1.2.14; < SL-alpha4 Fixed in 1.2.14 Patch available CNA
CPE configurations NVD · 4
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:ballerina:ballerina:*:*:*:*:*:*:*:* | before 1.2.14 | Vulnerable | Ballerina |
| cpe:2.3:a:ballerina:swan_lake:alpha1:*:*:*:*:*:*:* | alpha1 | Vulnerable | Ballerina |
| cpe:2.3:a:ballerina:swan_lake:alpha2:*:*:*:*:*:*:* | alpha2 | Vulnerable | Ballerina |
| cpe:2.3:a:ballerina:swan_lake:alpha3:*:*:*:*:*:*:* | alpha3 | Vulnerable | Ballerina |
- cpe:2.3:a:ballerina:ballerina:*:*:*:*:*:*:*:* Versions before 1.2.14 Vulnerable ·Ballerina
- cpe:2.3:a:ballerina:swan_lake:alpha1:*:*:*:*:*:*:* Versions alpha1 Vulnerable ·Ballerina
- cpe:2.3:a:ballerina:swan_lake:alpha2:*:*:*:*:*:*:* Versions alpha2 Vulnerable ·Ballerina
- cpe:2.3:a:ballerina:swan_lake:alpha3:*:*:*:*:*:*:* Versions alpha3 Vulnerable ·Ballerina
Remediation
- Fix · CNA ballerina-lang (ballerina-platform) Fixed in 1.2.14
Timeline
- 2026-10-02 Threatist record created from CVE-2021-32700
- 2026-10-03 Alias added: GHSA-jpjf-qc9h-8jgp
References
Sources
- CVE-2021-32700 · CVE Program
- CVE-2021-32700 · NVD
- FIRST EPSS
- GHSA-jpjf-qc9h-8jgp · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences