MEDIUM
gradle: Insecure HTTP URL used to download dependencies leading to possibly maliciously compromised artifacts.
Published Apr 9, 2019
5.9
MEDIUMCVSS 3.1
EPSS 1.58%
Description
Gradle versions from 1.4 to 5.3.1 use an insecure HTTP URL to download dependencies when the built-in JavaScript or CoffeeScript Gradle plugins are used. Dependency artifacts could have been maliciously compromised by a MITM attack against the ajax.googleapis.com web site.
Affected products
No data.
Configuration 2
OR
- 28
- 29
- 30
No data.
Red Hat JBoss Enterprise Web Server 3
gradle
Out of support scope
| Product | Package | State | Advisory |
|---|---|---|---|
| Red Hat JBoss Enterprise Web Server 3 | gradle | Out of support scope | n/a |
No package ranges for this CVE.
Remediation
No remediation recorded yet.
References (12)
- https://access.redhat.com/security/cve/CVE-2019-11065 Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=1698508 Issue Tracking
- https://github.com/advisories/GHSA-pprq-4488-wgqx Advisory
- https://github.com/gradle/gradle/pull/8927 x_refsource_MISCIssue TrackingPatch
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WVXOXNLAYRGPKAZV63PYNV3HF27JW2MW/ vendor-advisoryx_refsource_FEDORA
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Y43P7SVDJOG6OUDVFR4ZIDITZLNHPGTO/ vendor-advisoryx_refsource_FEDORA
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YQ5CGOV5QVQCSPGE3WRZDKUGIXLHSZDR/ vendor-advisoryx_refsource_FEDORA
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WVXOXNLAYRGPKAZV63PYNV3HF27JW2MW/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/Y43P7SVDJOG6OUDVFR4ZIDITZLNHPGTO/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YQ5CGOV5QVQCSPGE3WRZDKUGIXLHSZDR/
- https://nvd.nist.gov/vuln/detail/CVE-2019-11065
- https://www.cve.org/CVERecord?id=CVE-2019-11065
Change history (0)
No recorded changes yet.
Sources
CVE.org / MITRE
Status PUBLISHED
Assigner mitre
Published Apr 9, 2019
Updated Aug 4, 2024
Reserved Apr 9, 2019
Link CVE-2019-11065
CISA Vulnrichment
GHSA-PPRQ-4488-WGQX Updated n/a