Gradle up to 6.9.3/7.6.0 PHP Key inclusion of functionality from untrusted control sphere

Summaryinfo

A vulnerability marked as problematic has been reported in Gradle up to 6.9.3/7.6.0. This issue affects some unknown processing of the component PHP Key Handler. The manipulation leads to inclusion of functionality from untrusted control sphere. This vulnerability is traded as CVE-2023-26053. It is possible to initiate the attack remotely. There is no exploit available. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as problematic, has been found in Gradle up to 6.9.3/7.6.0. This issue affects an unknown code of the component PHP Key Handler. The manipulation with an unknown input leads to a inclusion of functionality from untrusted control sphere vulnerability. Using CWE to declare the problem leads to CWE-829. The product imports, requires, or includes executable functionality (such as a library) from a source that is outside of the intended control sphere. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

Gradle is a build tool with a focus on build automation and support for multi-language development. This is a collision attack on long IDs (64bits) for PGP keys. Users of dependency verification in Gradle are vulnerable if they use long IDs for PGP keys in a `trusted-key` or `pgp` element in their dependency verification metadata file. The fix is to fail dependency verification if anything but a fingerprint is used in a trust element in dependency verification metadata. The problem is fixed in Gradle 8.0 and above. The problem is also patched in Gradle 6.9.4 and 7.6.1. As a workaround, use only full fingerprint IDs for `trusted-key` or `pgp` element in the metadata is a protection against this issue.

The weakness was shared 03/02/2023 as GHSA-c724-3xg7-g3hf. The advisory is shared at github.com. The identification of this vulnerability is CVE-2023-26053 since 02/17/2023. Neither technical details nor an exploit are publicly available.

Upgrading to version 6.9.4, 7.6.1 or 8.0 eliminates this vulnerability. Applying the patch bf3cc0f2b463033037e67aaacda31291643ea1a9 is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Name

• Gradle

Version

• 6.9.0
• 6.9.1
• 6.9.2
• 6.9.3
• 7.0
• 7.1
• 7.2
• 7.3
• 7.4
• 7.5
• 7.6.0

License

• open-source

Website

• Product: https://github.com/gradle/gradle/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion