Gradle up to 7.4.2 Dependency Verification inclusion of functionality from untrusted control sphere

Summaryinfo

A vulnerability marked as problematic has been reported in Gradle up to 7.4.2. This vulnerability affects unknown code of the component Dependency Verification. The manipulation leads to inclusion of functionality from untrusted control sphere. This vulnerability is documented as CVE-2022-31156. The attack can be initiated remotely. There is not any exploit available. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability was found in Gradle up to 7.4.2. It has been rated as problematic. This issue affects an unknown code of the component Dependency Verification. The manipulation with an unknown input leads to a inclusion of functionality from untrusted control sphere vulnerability. Using CWE to declare the problem leads to CWE-829. The product imports, requires, or includes executable functionality (such as a library) from a source that is outside of the intended control sphere. Impacted is confidentiality. The summary by CVE is:

Gradle is a build tool. Dependency verification is a security feature in Gradle Build Tool that was introduced to allow validation of external dependencies either through their checksum or cryptographic signatures. In versions 6.2 through 7.4.2, there are some cases in which Gradle may skip that verification and accept a dependency that would otherwise fail the build as an untrusted external artifact. This can occur in two ways. When signature verification is disabled but the verification metadata contains entries for dependencies that only have a `gpg` element but no `checksum` element. When signature verification is enabled, the verification metadata contains entries for dependencies with a `gpg` element but there is no signature file on the remote repository. In both cases, the verification will accept the dependency, skipping signature verification and not complaining that the dependency has no checksum entry. For builds that are vulnerable, there are two risks. Gradle could download a malicious binary from a repository outside your organization due to name squatting. For those still using HTTP only and not HTTPS for downloading dependencies, the build could download a malicious library instead of the expected one. Gradle 7.5 patches this issue by making sure to run checksum verification if signature verification cannot be completed, whatever the reason. Two workarounds are available: Remove all `gpg` elements from dependency verification metadata if you disable signature validation and/or avoid adding `gpg` entries for dependencies that do not have signature files.

The weakness was released 07/15/2022 as GHSA-j6wc-xfg8-jx2j. The advisory is shared at github.com. The identification of this vulnerability is CVE-2022-31156 since 05/18/2022. Neither technical details nor an exploit are publicly available.

Upgrading to version 7.5 eliminates this vulnerability.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Name

• Gradle

Version

• 7.4.0
• 7.4.1
• 7.4.2

Website

• Product: https://github.com/gradle/gradle/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion