PT-2021-18205 · Gradle+2 · Gradle+2
Big-Guy
+1
·
Published
2021-04-12
·
Updated
2024-04-05
·
CVE-2021-29429
CVSS v3.1
5.5
Medium
| Vector | AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N |
Name of the Vulnerable Software and Affected Versions:
Gradle versions prior to 7.0
Description:
The issue allows an attacker to access information downloaded by Gradle due to files created with open permissions in the system temporary directory. This can lead to a local information disclosure, particularly affecting builds that use the
TextResourceFactory API. Sensitive information in downloaded files can be exposed to other local users on the same system. As of Gradle 7.0, the system temporary directory is no longer used, and instead, the Gradle User Home directory is utilized, which is restricted to the user running the build by default.Recommendations:
For versions prior to 7.0, as a temporary workaround, consider setting a more restrictive umask that removes read access to other users. This will prevent files created in the system temporary directory from being accessible to other users. Alternatively, if you are unable to change your system's umask, you can move the Java temporary directory by setting the System Property
java.io.tmpdir to a new path that limits permissions to the build user only.Exploit
Fix
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Debian
Gradle
Suse