PT-2021-17112

Name of the Vulnerable Software and Affected Versions Gradle gradle-enterprise-test-distribution-agent versions prior to 1.3.2 Gradle test-distribution-gradle-plugin versions prior to 1.3.2 Gradle gradle-enterprise-maven-extension versions prior to 1.8.2 Description A directory traversal issue...

gradle.plugin.io.jooby:jooby-gradle-plugin (>=2.7.0, <=2.8.1), io.jooby.openapi:io.jooby.openapi.gradle.plugin (>=2.7.0, <=2.8.1) +33 more potentially affected by CVE-2020-7647 via io.jooby:jooby (>=2.0.0.m1, <=2.8.1)

io.jooby:jooby MAVEN version =2.0.0.m1, =2.7.0, =2.7.0, =2.7.0, =2.1.0, =2.6.0, =2.0.6, =2.6.1, =2.0.0, =2.0.0.m1, =2.4.0, =2.4.0, =2.4.0, =2.7.2, =2.0.0.m2, =2.0.0.m1, =2.8.1 and more Source cves: CVE-2020-7647 Source advisory: MEND:CVE-2020-7647...

CVE-2020-7599

All versions of com.gradle.plugin-publish before 0.11.0 are vulnerable to Insertion of Sensitive Information into Log File. When a plugin author publishes a Gradle plugin while running Gradle with the --info log level flag, the Gradle Logger logs an AWS pre-signed URL. If this build log is public...

CVE-2020-7599

All versions of com.gradle.plugin-publish before 0.11.0 are vulnerable to Insertion of Sensitive Information into Log File. When a plugin author publishes a Gradle plugin while running Gradle with the --info log level flag, the Gradle Logger logs an AWS pre-signed URL. If this build log is public...

Code injection

All versions of com.gradle.plugin-publish before 0.11.0 are vulnerable to Insertion of Sensitive Information into Log File. When a plugin author publishes a Gradle plugin while running Gradle with the --info log level flag, the Gradle Logger logs an AWS pre-signed URL. If this build log is public...

CVE-2020-7599

All versions of com.gradle.plugin-publish before 0.11.0 are vulnerable to Insertion of Sensitive Information into Log File. When a plugin author publishes a Gradle plugin while running Gradle with the --info log level flag, the Gradle Logger logs an AWS pre-signed URL. If this build log is public...

Insertion of Sensitive Information into Log File

Overview com.gradle.plugin-publish:com.gradle.plugin-publish.gradle.plugin is a plugin that publishes plugins to the Gradle Plugin Portal. Affected versions of this package are vulnerable to Insertion of Sensitive Information into Log File. When a plugin author publishes a Gradle plugin while...

org.stoyicker.android-check:org.stoyicker.android-check.gradle.plugin (>=2.149.1, <=2.161), org.stoyicker.android-check:plugin (>=2.149.1, <=2.161) potentially affected by CVE-2019-10782 via com.puppycrawl.tools:checkstyle (7.5)

com.puppycrawl.tools:checkstyle MAVEN version 7.5 is affected by a known vulnerability. The following packages have a transitive dependency on com.puppycrawl.tools:checkstyle and may be impacted: - org.stoyicker.android-check:org.stoyicker.android-check.gradle.plugin =2.149.1, =2.149.1, =2.161...

DEBIAN-CVE-2019-16370

The PGP signing plugin in Gradle before 6.0 relies on the SHA-1 algorithm, which might allow an attacker to replace an artifact with a different one that has the same SHA-1 message digest, a related issue to CVE-2005-4900...

Improper Restriction of XML External Entity Reference in DiffPlug Spotless

In DiffPlug Spotless before 1.20.0 library and Maven plugin and before 3.20.0 Gradle plugin, the XML parser would resolve external entities over both HTTP and HTTPS and didn't respect the resolveExternalEntities setting. For example, this allows disclosure of file contents to a MITM attacker if a...

com.bonitasoft.gradle.bonita-formatting:com.bonitasoft.gradle.bonita-formatting.gradle.plugin (>=0.1.37, <=0.1.43), com.bonitasoft.gradle.bonita-release:com.bonitasoft.gradle.bonita-release.gradle.plugin (>=0.1.37, <=0.1.43) +26 more potentially affected by CVE-2019-9843 via com.diffplug.spotless:spotless-plugin-gradle (>=3.0.0.beta2, <=3.19.0)

com.diffplug.spotless:spotless-plugin-gradle MAVEN version =3.0.0.beta2, =0.1.37, =0.1.37, =0.1.37, =0.1.37, =0.1.37, =0.1.37, =0.1.37, =0.1.37, =3.0.0.beta2, =0.2, =0...

CVE-2019-9843

In DiffPlug Spotless before 1.20.0 library and Maven plugin and before 3.20.0 Gradle plugin, the XML parser would resolve external entities over both HTTP and HTTPS and didn't respect the resolveExternalEntities setting. For example, this allows disclosure of file contents to a MITM attacker if a...

com.bonitasoft.gradle.bonita-formatting:com.bonitasoft.gradle.bonita-formatting.gradle.plugin (>=0.1.37, <=0.1.43), com.bonitasoft.gradle.bonita-release:com.bonitasoft.gradle.bonita-release.gradle.plugin (>=0.1.37, <=0.1.43) +26 more potentially affected by CVE-2019-9843 via com.diffplug.spotless:spotless-plugin-gradle (>=3.0.0.beta2, <=3.19.0)

com.diffplug.spotless:spotless-plugin-gradle MAVEN version =3.0.0.beta2, =0.1.37, =0.1.37, =0.1.37, =0.1.37, =0.1.37, =0.1.37, =0.1.37, =0.1.37, =3.0.0.beta2, =0.2, =0...

CVE-2019-9843: Improper Restriction of XML External Entity Reference

In DiffPlug Spotless before 1.20.0 library and Maven plugin and before 3.20.0 Gradle plugin, the XML parser would resolve external entities over both HTTP and HTTPS and didn't respect the resolveExternalEntities setting. For example, this allows disclosure of file contents to a MITM attacker if a...

org.cloudfoundry:cf-gradle-plugin (>=1.0.1, <=1.0.3), org.cloudfoundry:cf-maven-plugin (>=1.0.1, <=1.0.3) +1 more potentially affected by CVE-2019-3778 via org.springframework.security.oauth:spring-security-oauth2 (1.0.0.release)

org.springframework.security.oauth:spring-security-oauth2 MAVEN version 1.0.0.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security.oauth:spring-security-oauth2 and may be impacted: - org.cloudfoundry:cf-gradle-plugin...

org.cloudfoundry:cf-gradle-plugin (>=1.0.1, <=1.0.3), org.cloudfoundry:cf-maven-plugin (>=1.0.1, <=1.0.3) +5 more potentially affected by CVE-2016-4977 via org.springframework.security.oauth:spring-security-oauth2 (>=1.0.0.release, <=1.0.2.release)

org.springframework.security.oauth:spring-security-oauth2 MAVEN version =1.0.0.release, =1.0.1, =1.0.1, =1.0.1, =0.9.0, =0.9.0, =0.9.0, =0.9.0, =1.0.22 Source cves: CVE-2016-4977 Source advisory: GHSA-7Q9C-H23X-65FQ...

org.cloudfoundry:cf-gradle-plugin (>=1.0.1, <=1.0.3), org.cloudfoundry:cf-maven-plugin (>=1.0.1, <=1.0.3) +5 more potentially affected by CVE-2016-4977 via org.springframework.security.oauth:spring-security-oauth2 (>=1.0.0.release, <=1.0.2.release)

org.springframework.security.oauth:spring-security-oauth2 MAVEN version =1.0.0.release, =1.0.1, =1.0.1, =1.0.1, =0.9.0, =0.9.0, =0.9.0, =0.9.0, =1.0.22 Source cves: CVE-2016-4977 Source advisory: OSV:GHSA-7Q9C-H23X-65FQ...

UPDATE: OWASP Dependency-Check 2.1.0!

PenTestIT RSS Feed My first post about this open source OWASP project was about an older version. This post discusses the changes made to the open source software composition analysis utility in the latest release yesterday. This is the OWASP Dependency-Check 2.1.0! What I like about this release...

ProGuard - Java class file Shrinker, Optimizer, Obfuscator and Preverifier

ProGuard is a free Java class file shrinker, optimizer, obfuscator, and preverifier. It detects and removes unused classes, fields, methods, and attributes. It optimizes bytecode and removes unused instructions. It renames the remaining classes, fields, and methods using short meaningless names...

com.korwe:kordapt-core (>=1.0.1, <=1.1.2), com.korwe:kordapt-gradle-plugin (>=1.0.1, <=1.1.2) +12 more potentially affected by CVE-2012-4446 via org.apache.qpid:qpid-client (>=0.10, <=0.18)

org.apache.qpid:qpid-client MAVEN version =0.10, =1.0.1, =1.0.1, =1.0.1, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =5.8.0-ness-1, =0.4.0, =2.7.5, =1.0.3, =0.7.0.final, =0.8.0.final Source cves: CVE-2012-4446 Source advisory: MEND:CVE-2012-4446...