Bug 1698508 (CVE-2019-11065) - CVE-2019-11065 gradle: Insecure HTTP URL used to download dependencies leading to possibly maliciously compromised artifacts.
Summary: CVE-2019-11065 gradle: Insecure HTTP URL used to download dependencies leadin...
Keywords:
Status: CLOSED WONTFIX
Alias: CVE-2019-11065
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
high
high
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1698509 1698510 1698511
Blocks: 1699296
TreeView+ depends on / blocked
 
Reported: 2019-04-10 14:04 UTC by Marian Rehak
Modified: 2020-03-23 14:51 UTC (History)
14 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
A flaw was discovered in Gradle, where it uses an insecure HTTP URL to download dependencies. This flaw causes dependency artifacts to be maliciously compromised by a Man-in-the-middle(MITM) attack.
Clone Of:
Environment:
Last Closed: 2019-09-10 12:45:32 UTC
Embargoed:

Attachments (Terms of Use)

Description Marian Rehak 2019-04-10 14:04:26 UTC 
 Gradle versions from 1.4 to 5.3.1 use an insecure HTTP URL to download dependencies when the built-in JavaScript or CoffeeScript Gradle plugins are used. Dependency artifacts could have been maliciously compromised by a MITM attack against the ajax.googleapis.com web site.
Comment 1 Marian Rehak 2019-04-10 14:04:40 UTC 
Created gradle tracking bugs for this issue:

Affects: epel-6 [bug 1698511]
Affects: fedora-28 [bug 1698509]
Affects: fedora-29 [bug 1698510]
Comment 2 Fedora Update System 2019-05-21 02:20:06 UTC 
gradle-4.3.1-9.fc29 has been pushed to the Fedora 29 stable repository. If problems still persist, please make note of it in this bug report.
Comment 4 Product Security DevOps Team 2019-09-10 12:45:32 UTC 
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2019-11065
Note You need to log in before you can comment on or make changes to this bug.