CVE-2019-11065
MEDIUMGradle 1.4-5.3.1 - Dependency Download Man-in-the-Middle via Insecure HTTP URL
Title source: llmDescription
Gradle versions from 1.4 to 5.3.1 use an insecure HTTP URL to download dependencies when the built-in JavaScript or CoffeeScript Gradle plugins are used. Dependency artifacts could have been maliciously compromised by a MITM attack against the ajax.googleapis.com web site.
References (4)
Core 4
Core References
Issue Tracking, Patch x_refsource_misc
https://github.com/gradle/gradle/pull/8927
Mailing List, Third Party Advisory vendor-advisory
x_refsource_fedora
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Y43P7SVDJOG6OUDVFR4ZIDITZLNHPGTO/
Mailing List, Third Party Advisory vendor-advisory
x_refsource_fedora
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WVXOXNLAYRGPKAZV63PYNV3HF27JW2MW/
Mailing List, Third Party Advisory vendor-advisory
x_refsource_fedora
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YQ5CGOV5QVQCSPGE3WRZDKUGIXLHSZDR/
Scores
CVSS v3
5.9
EPSS
0.0137
EPSS Percentile
68.9%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Details
Status
published
Products (5)
fedoraproject/fedora
28
fedoraproject/fedora
29
fedoraproject/fedora
30
gradle/gradle
1.4 - 5.3.1
org.gradle/gradle-core
1.4 - 5.4.0Maven
Published
Apr 10, 2019
Tracked Since
Feb 18, 2026