gradle vulnerabilities

2021-03-1522:44:10

Google

osv.dev

gradle

vulnerabilities

insecure http url

javascript

coffeescript

remote unauthenticated attacker

machine-in-the-middle attack

pgp signing plugin

sha-1 algorithm

spoofing attacks

software

AI Score

6.8

Confidence

Low

EPSS

0.002

Percentile

52.0%

JSON

It was discovered that Gradle used an insecure HTTP URL to download
dependencies when the built-in JavaScript or CoffeeScript Gradle plugins
were used. A remote unauthenticated attacker could possibly use this issue
to perform a machine-in-the-middle attack. (CVE-2019-11065)

It was discovered that the PGP signing plugin in Gradle relied on the
insecure SHA-1 algorithm. An attacker could possibly use this issue to
conduct spoofing attacks. (CVE-2019-16370)