CVE-2019-19251 — The Last.fm desktop app (Last.fm Scrobbler) through 2.1.39 on macOS makes HTTP requests that include an API key without the use of SSL/TLS

Matched remediation archetype

Cryptography, certificate, signature, and channel validation

This catalog composition supplies bounded fallback guidance. Explicitly reviewed curated workflows load with the complete record below.

Check exposure

• Inventory affected algorithms, key uses, trust stores, certificate validation settings, random sources, and plaintext channels across clients and services.
• Determine which secrets, identities, signatures, or data protections depend on the affected primitive or validation path.
• Check debug, compatibility, fallback, and hostname or audience override settings in build and runtime configuration.

Remediate safely

• Use a maintained platform cryptographic API with approved algorithms, modes, parameters, randomness, and full peer identity validation.
• Remove insecure fallback and validation bypasses; separate keys by purpose and load them from managed secret storage.
• Plan rotation or reissuance for affected keys, certificates, tokens, hashes, or ciphertext and document compatibility sequencing.