PT-2019-12162 · Gradle+1 · Gradle+1

Mikolaj Izdebski · Publicado 2019-04-09 · Atualizado 2023-03-01 · CVE-2019-11065

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Média

Vetor base

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Gradle versions 1.4 through 5.3.1

Description The issue arises from Gradle using an insecure HTTP URL to download dependencies when the built-in JavaScript or CoffeeScript Gradle plugins are used. This could allow dependency artifacts to be maliciously compromised by a Man-In-The-Middle (MITM) attack against the ajax.googleapis.com website.

Recommendations For Gradle versions 1.4 through 5.3.1, consider updating the plugin configurations to use secure HTTPS URLs for dependency downloads as a temporary workaround. Restrict access to the affected plugins to minimize the risk of exploitation.

Correção

Cleartext Transmission of Sensitive Information

Enumeração de Fraquezas

CWE-319

Identificadores relacionados

CVE-2019-11065

GHSA-PPRQ-4488-WGQX

USN-4858-1

Produtos afetados

Gradle

Ubuntu

Referências · 19

• https://github.com/gradle/gradle/pull/8927 · Correção
• https://github.com/gradle/gradle · Nota
• https://osv.dev/vulnerability/GHSA-pprq-4488-wgqx · Aviso do Fabricante
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/YQ5CGOV5QVQCSPGE3WRZDKUGIXLHSZDR · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2019-11065 · Nota de Segurança
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/WVXOXNLAYRGPKAZV63PYNV3HF27JW2MW · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2019-11065 · Aviso do Fabricante
• https://cve.org/CVERecord?id=CVE-2019-11065 · Nota de Segurança
• https://ubuntu.com/security/CVE-2019-16370 · Aviso do Fabricante
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Y43P7SVDJOG6OUDVFR4ZIDITZLNHPGTO · Aviso do Fabricante
• https://security-tracker.debian.org/tracker/CVE-2019-11065 · Aviso do Fabricante
• https://osv.dev/vulnerability/DEBIAN-CVE-2019-11065 · Aviso do Fabricante
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WVXOXNLAYRGPKAZV63PYNV3HF27JW2MW · Aviso do Fabricante
• https://ubuntu.com/security/notices/USN-4858-1 · Aviso do Fabricante
• https://osv.dev/vulnerability/USN-4858-1 · Aviso do Fabricante