Bug 1949638 (CVE-2021-29427) - CVE-2021-29427 gradle: repository content filters do not work in Settings pluginManagement
Summary: CVE-2021-29427 gradle: repository content filters do not work in Settings plu...
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2021-29427
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks: 1949646
TreeView+ depends on / blocked
 
Reported: 2021-04-14 17:35 UTC by Guilherme de Almeida Suckevicz
Modified: 2022-05-18 13:45 UTC (History)
57 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2022-05-18 13:45:18 UTC
Embargoed:


Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2022:4623 0 None None None 2022-05-18 10:56:18 UTC

Description Guilherme de Almeida Suckevicz 2021-04-14 17:35:07 UTC
In Gradle from version 5.1 and before version 7.0 there is a vulnerability which can lead to information disclosure and/or dependency poisoning. Repository content filtering is a security control Gradle introduced to help users specify what repositories are used to resolve specific dependencies. This feature was introduced in the wake of the "A Confusing Dependency" blog post. In some cases, Gradle may ignore content filters and search all repositories for dependencies. This only occurs when repository content filtering is used from within a `pluginManagement` block in a settings file. This may change how dependencies are resolved for Gradle plugins and build scripts. For builds that are vulnerable, there are two risks: 1) Information disclosure: Gradle could make dependency requests to repositories outside your organization and leak internal package identifiers. 2) Dependency poisoning/Dependency confusion: Gradle could download a malicious binary from a repository outside your organization due to name squatting. For a full example and more details refer to the referenced GitHub Security Advisory. The problem has been patched and released with Gradle 7.0. Users relying on this feature should upgrade their build as soon as possible. As a workaround, users may use a company repository which has the right rules for fetching packages from public repositories, or use project level repository content filtering, inside `buildscript.repositories`. This option is available since Gradle 5.1 when the feature was introduced.

Reference:
https://github.com/gradle/gradle/security/advisories/GHSA-jvmj-rh6q-x395

Comment 2 Jonathan Christison 2021-04-30 16:25:19 UTC
Marking Camel K and Camel Quarkus as having a low impact, although both products ship indirectly vulnerable artifacts (gradle-wrapper) these artifacts are not available for use by application developers and are not used during the build of either product.

Comment 15 errata-xmlrpc 2022-05-18 10:56:14 UTC
This issue has been addressed in the following products:

  Red Hat build of Quarkus 2.7.5

Via RHSA-2022:4623 https://access.redhat.com/errata/RHSA-2022:4623

Comment 16 Product Security DevOps Team 2022-05-18 13:45:14 UTC
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2021-29427


Note You need to log in before you can comment on or make changes to this bug.