Bug 1698508 (CVE-2019-11065)
| Summary: | CVE-2019-11065 gradle: Insecure HTTP URL used to download dependencies leading to possibly maliciously compromised artifacts. | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | Marian Rehak <mrehak> |
| Component: | vulnerability | Assignee: | Red Hat Product Security <security-response-team> |
| Status: | CLOSED WONTFIX | QA Contact: | |
| Severity: | high | Docs Contact: | |
| Priority: | high | ||
| Version: | unspecified | CC: | csutherl, dan, gzaronik, java-sig-commits, jclere, jjelen, lgao, lkundrak, mbabacek, mizdebsk, msimacek, myarboro, twalsh, weli |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | If docs needed, set a value | |
| Doc Text: |
A flaw was discovered in Gradle, where it uses an insecure HTTP URL to download dependencies. This flaw causes dependency artifacts to be maliciously compromised by a Man-in-the-middle(MITM) attack.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | 2019-09-10 12:45:32 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 1698509, 1698510, 1698511 | ||
| Bug Blocks: | 1699296 | ||
|
Description
Marian Rehak
2019-04-10 14:04:26 UTC
Created gradle tracking bugs for this issue: Affects: epel-6 [bug 1698511] Affects: fedora-28 [bug 1698509] Affects: fedora-29 [bug 1698510] gradle-4.3.1-9.fc29 has been pushed to the Fedora 29 stable repository. If problems still persist, please make note of it in this bug report. This bug is now closed. Further updates for individual products will be reflected on the CVE page(s): https://access.redhat.com/security/cve/cve-2019-11065 |