Cette page suit l'état du correctif pour Debian. La vulnérabilité elle-même est décrite sur la page CVE principale. Voir CVE-2019-11065 →

DEBIAN-CVE-2019-11065

Gradle versions from 1.4 to 5.3.1 use an insecure HTTP URL to download dependencies when the built-in JavaScript or CoffeeScript Gradle plugins are us...

Description d'origine

La description telle que publiée par la source (souvent en anglais).

Gradle versions from 1.4 to 5.3.1 use an insecure HTTP URL to download dependencies when the built-in JavaScript or CoffeeScript Gradle plugins are used. Dependency artifacts could have been maliciously compromised by a MITM attack against the ajax.googleapis.com web site.

Source: OSV.dev (Open Source Vulnerabilities) OSV

Paquets affectés

Debian:12 gradle

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.1-10"}]}]

Debian:13 gradle

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.1-10"}]}]

Debian:14 gradle

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.1-10"}]}]

Références

advisory security-tracker.debian.org