PT-2019-12162 · Gradle+1 · Gradle+1

Mikolaj Izdebski · Published 2019-04-09 · Updated 2023-03-01 · CVE-2019-11065

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Gradle versions 1.4 through 5.3.1

Description The issue arises from Gradle using an insecure HTTP URL to download dependencies when the built-in JavaScript or CoffeeScript Gradle plugins are used. This could allow dependency artifacts to be maliciously compromised by a Man-In-The-Middle (MITM) attack against the ajax.googleapis.com website.

Recommendations For Gradle versions 1.4 through 5.3.1, consider updating the plugin configurations to use secure HTTPS URLs for dependency downloads as a temporary workaround. Restrict access to the affected plugins to minimize the risk of exploitation.

Fix

Cleartext Transmission of Sensitive Information

Weakness Enumeration

CWE-319

Related Identifiers

CVE-2019-11065

GHSA-PPRQ-4488-WGQX

USN-4858-1

Affected Products

Gradle

Ubuntu

References · 19

• https://github.com/gradle/gradle/pull/8927 · Patch
• https://osv.dev/vulnerability/GHSA-pprq-4488-wgqx · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/YQ5CGOV5QVQCSPGE3WRZDKUGIXLHSZDR · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-11065 · Security Note
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/WVXOXNLAYRGPKAZV63PYNV3HF27JW2MW · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-11065 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2019-11065 · Security Note
• https://ubuntu.com/security/CVE-2019-16370 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Y43P7SVDJOG6OUDVFR4ZIDITZLNHPGTO · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2019-11065 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2019-11065 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WVXOXNLAYRGPKAZV63PYNV3HF27JW2MW · Vendor Advisory
• https://ubuntu.com/security/notices/USN-4858-1 · Vendor Advisory
• https://osv.dev/vulnerability/USN-4858-1 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2019-11065 · Vendor Advisory