https://bugzilla.redhat.com/show_bug.cgi?id=1758992
Bug ID: 1758992
Summary: CVE-2019-16370 gradle: PGP signing plugin security
bypass
Product: Security Response
Hardware: All
OS: Linux
Status: NEW
Component: vulnerability
Keywords: Security
Severity: medium
Priority: medium
Assignee: security-response-team(a)redhat.com
Reporter: darunesh(a)redhat.com
CC: csutherl(a)redhat.com, dan(a)danieljamesscott.org,
decathorpe(a)gmail.com, gzaronik(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
jclere(a)redhat.com, jjelen(a)redhat.com, lgao(a)redhat.com,
lkundrak(a)v3.sk, mbabacek(a)redhat.com,
mizdebsk(a)redhat.com, msimacek(a)redhat.com,
myarboro(a)redhat.com, twalsh(a)redhat.com,
weli(a)redhat.com
Target Milestone: ---
Classification: Other
The PGP signing plugin in Gradle before 6.0 relies on the SHA-1 algorithm,
which might allow an attacker to replace an artifact with a different one that
has the same SHA-1 message digest, a related issue to CVE-2005-4900.
Reference:
https://github.com/gradle/gradle/commit/425b2b7a50cd84106a77cdf1ab665c89c...
https://github.com/gradle/gradle/pull/10543
--
You are receiving this mail because:
You are on the CC list for the bug.