This page tracks the Debian fix status. The vulnerability itself is described on the main CVE page. View CVE-2019-11065 →

DEBIAN-CVE-2019-11065

Gradle versions from 1.4 to 5.3.1 use an insecure HTTP URL to download dependencies when the built-in JavaScript or CoffeeScript Gradle plugins are us...

Original description

The description as published by the source.

Gradle versions from 1.4 to 5.3.1 use an insecure HTTP URL to download dependencies when the built-in JavaScript or CoffeeScript Gradle plugins are used. Dependency artifacts could have been maliciously compromised by a MITM attack against the ajax.googleapis.com web site.

Source: OSV.dev (Open Source Vulnerabilities) OSV

Affected packages

Debian:12 gradle

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.1-10"}]}]

Debian:13 gradle

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.1-10"}]}]

Debian:14 gradle

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.1-10"}]}]

References

advisory security-tracker.debian.org