USN-4858-1: Gradle vulnerabilities

Releases

• Ubuntu 18.04 ESM

Packages

• gradle - Powerful build system for the JVM

Details

It was discovered that Gradle used an insecure HTTP URL to download
dependencies when the built-in JavaScript or CoffeeScript Gradle plugins
were used. A remote unauthenticated attacker could possibly use this issue
to perform a machine-in-the-middle attack. (CVE-2019-11065)

It was discovered that the PGP signing plugin in Gradle relied on the
insecure SHA-1 algorithm. An attacker could possibly use this issue to
conduct spoofing attacks. (CVE-2019-16370)

Update instructions

The problem can be corrected by updating your system to the following package versions:

Ubuntu 18.04

• libgradle-core-java - 4.4.1-5ubuntu2~18.04+esm1
  Available with Ubuntu Pro
• libgradle-plugins-java - 4.4.1-5ubuntu2~18.04+esm1
  Available with Ubuntu Pro
• gradle - 4.4.1-5ubuntu2~18.04+esm1
  Available with Ubuntu Pro

In general, a standard system update will make all the necessary changes.

References

• CVE-2019-16370
• CVE-2019-11065