USN-4858-1

Dashboard / Vulnerabilities / USN-4858-1

USN-4858-1

Summary: gradle vulnerabilities

Details: It was discovered that Gradle used an insecure HTTP URL to download dependencies when the built-in JavaScript or CoffeeScript Gradle plugins were used. A remote unauthenticated attacker could possibly use this issue to perform a machine-in-the-middle attack. (CVE-2019-11065) It was discovered that the PGP signing plugin in Gradle relied on the insecure SHA-1 algorithm. An attacker could possibly use this issue to conduct spoofing attacks. (CVE-2019-16370)

References: https://ubuntu.com/security/notices/USN-4858-1, https://ubuntu.com/security/CVE-2019-11065, https://ubuntu.com/security/CVE-2019-16370