CVE-2019-11065
Medium
Description
Gradle versions from 1.4 to 5.3.1 use an insecure HTTP URL to download dependencies when the built-in JavaScript or CoffeeScript Gradle plugins are used. Dependency artifacts could have been maliciously compromised by a MITM attack against the ajax.googleapis.com web site.
SeverityMedium
CVSS5.9
Exploit probability—
Product
Gradle
PublishedApr 10, 2019
First seenApr 10, 2019
How to fix
Update
- org.gradle:gradle-core5.4.0 or later
Vendor advisories
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Y43P7SVDJOG6OUDVFR4ZIDITZLNHPGTO/
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WVXOXNLAYRGPKAZV63PYNV3HF27JW2MW/
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YQ5CGOV5QVQCSPGE3WRZDKUGIXLHSZDR/
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| gradle gradle | 1.4 ≤ v ≤ 5.3.1 | — |
| fedoraproject fedora | 28, 29, 30 | — |
| org.gradle:gradle-coreMaven | 1.4 ≤ v < 5.4.0 | 5.4.0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.