PT-2023-20453 · Gradle · Gradle

Published 2023-03-02 · Updated 2024-03-06 · CVE-2023-26053

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Gradle versions prior to 6.9.4 Gradle versions prior to 7.6.1 Gradle versions prior to 8.0

Description This issue is a collision attack on long IDs (64bits) for PGP keys. Users of dependency verification in Gradle are vulnerable if they use long IDs for PGP keys in a trusted-key or pgp element in their dependency verification metadata file.

Recommendations For Gradle versions prior to 6.9.4, update to Gradle 6.9.4 or later. For Gradle versions prior to 7.6.1, update to Gradle 7.6.1 or later. For Gradle versions prior to 8.0, update to Gradle 8.0 or later. As a temporary workaround, consider using only full fingerprint IDs for trusted-key or pgp elements in the metadata to protect against this issue.

Exploit

Fix

Weakness Enumeration

CWE-829

Related Identifiers

BIT-GRADLE-2023-26053

CVE-2023-26053

GHSA-C724-3XG7-G3HF

Affected Products

Gradle

References · 12

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/26xxx/CVE-2023-26053.json · Exploit
• https://github.com/gradle/gradle/commit/bf3cc0f2b463033037e67aaacda31291643ea1a9 · Patch
• https://github.com/gradle/gradle/security/advisories/GHSA-c724-3xg7-g3hf · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-26053 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2023-26053 · Vendor Advisory
• https://ubuntu.com/security/CVE-2023-26053 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-gradle-2023-26053 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2023-26053 · Security Note
• https://osv.dev/vulnerability/CVE-2023-26053 · Vendor Advisory
• https://t.me/cibsecurity/59308 · Telegram Post
• https://security.netapp.com/advisory/ntap-20230413-0002 · Note
• https://t.me/cvenotify/45934 · Telegram Post