~ / search / GHSA-pprq-4488-wgqx

GHSA-pprq-4488-wgqx

Insecure transport protocol in Gradle

Source: GitHub Advisory Database (reviewed) Moderate CVE-2019-11065

Packages

EcosystemPackageAffectedFixed in
Maven org.gradle:gradle-core >= 1.4, < 5.4.0 5.4.0

Details

As written in the advisory (Markdown source, shown as plain text).

Gradle versions from 1.4 to 5.3.1 use an insecure HTTP URL to download dependencies when the built-in JavaScript or CoffeeScript Gradle plugins are used. Dependency artifacts could have been maliciously compromised by a MITM attack against the ajax.googleapis.com web site.

References

External links from the advisory. They lead to third-party sites.