PT-2020-19646 · Gradle · Com.Gradle.Plugin-Publish

Danny Thomas · Published 2020-03-30 · Updated 2022-05-24 · CVE-2020-7599

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions com.gradle.plugin-publish versions prior to 0.11.0

Description The issue allows for the insertion of sensitive information into log files. When a plugin author publishes a Gradle plugin while running Gradle with the --info log level flag, the Gradle Logger logs an AWS pre-signed URL. If this build log is publicly visible, as it is in many popular public CI systems like TravisCI, this AWS pre-signed URL would allow a malicious actor to replace a recently uploaded plugin with their own.

Recommendations For versions prior to 0.11.0, update to version 0.11.0 or later to resolve the issue. As a temporary workaround, consider avoiding the use of the --info log level flag when publishing Gradle plugins to minimize the risk of exploitation. Restrict access to build logs to prevent publicly visible AWS pre-signed URLs.

Fix

Insertion into Log File

Weakness Enumeration

CWE-532

Related Identifiers

CVE-2020-7599

GHSA-CV78-V957-JX34

SNYK-JAVA-COMGRADLEPLUGINPUBLISH-559866

Affected Products

Com.Gradle.Plugin-Publish

References · 7

• https://blog.gradle.org/plugin-portal-update · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-cv78-v957-jx34 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-7599 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-7599 · Security Note
• https://snyk.io/vuln/SNYK-JAVA-COMGRADLEPLUGINPUBLISH-559866 · Note
• https://t.me/cvenotify/2258 · Telegram Post
• https://plugins.gradle.org/plugin/com.gradle.plugin-publish · Note