UBUNTU-CVE-2022-31156

See a problem?
Please try reporting it to the source first.
Source
https://ubuntu.com/security/CVE-2022-31156
Import Source
https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2022/UBUNTU-CVE-2022-31156.json
JSON Data
https://api.test.osv.dev/v1/vulns/UBUNTU-CVE-2022-31156
Related
Published
2022-07-14T20:15:00Z
Modified
2024-10-15T14:09:58Z
Severity
  • 4.4 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:H/A:N CVSS Calculator
Summary
[none]
Details

Gradle is a build tool. Dependency verification is a security feature in Gradle Build Tool that was introduced to allow validation of external dependencies either through their checksum or cryptographic signatures. In versions 6.2 through 7.4.2, there are some cases in which Gradle may skip that verification and accept a dependency that would otherwise fail the build as an untrusted external artifact. This can occur in two ways. When signature verification is disabled but the verification metadata contains entries for dependencies that only have a gpg element but no checksum element. When signature verification is enabled, the verification metadata contains entries for dependencies with a gpg element but there is no signature file on the remote repository. In both cases, the verification will accept the dependency, skipping signature verification and not complaining that the dependency has no checksum entry. For builds that are vulnerable, there are two risks. Gradle could download a malicious binary from a repository outside your organization due to name squatting. For those still using HTTP only and not HTTPS for downloading dependencies, the build could download a malicious library instead of the expected one. Gradle 7.5 patches this issue by making sure to run checksum verification if signature verification cannot be completed, whatever the reason. Two workarounds are available: Remove all gpg elements from dependency verification metadata if you disable signature validation and/or avoid adding gpg entries for dependencies that do not have signature files.

References

Affected packages

Ubuntu:Pro:16.04:LTS / gradle

Package

Name
gradle
Purl
pkg:deb/ubuntu/gradle?arch=src?distro=esm-apps/xenial

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

2.*

2.5-3
2.7-1
2.7-2
2.7-3
2.10-1

Ecosystem specific 

{
    "ubuntu_priority": "medium"
}

Ubuntu:Pro:18.04:LTS / gradle

Package

Name
gradle
Purl
pkg:deb/ubuntu/gradle?arch=src?distro=esm-apps/bionic

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

3.*

3.2.1-3build2
3.2.1-4
3.2.1-5
3.4.1-4
3.4.1-6
3.4.1-7ubuntu1

4.*

4.4.1-5ubuntu2~18.04
4.4.1-5ubuntu2~18.04+esm1

Ecosystem specific 

{
    "ubuntu_priority": "medium"
}

Ubuntu:20.04:LTS / gradle

Package

Name
gradle
Purl
pkg:deb/ubuntu/gradle?arch=src?distro=focal

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

4.*

4.4.1-8
4.4.1-9
4.4.1-10

Ecosystem specific 

{
    "ubuntu_priority": "medium"
}

Ubuntu:22.04:LTS / gradle

Package

Name
gradle
Purl
pkg:deb/ubuntu/gradle?arch=src?distro=jammy

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

4.*

4.4.1-13

Ecosystem specific 

{
    "ubuntu_priority": "medium"
}

Ubuntu:24.10 / gradle

Package

Name
gradle
Purl
pkg:deb/ubuntu/gradle?arch=src?distro=oracular

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

4.*

4.4.1-20
4.4.1-20build1

Ecosystem specific 

{
    "ubuntu_priority": "medium"
}

Ubuntu:24.04:LTS / gradle

Package

Name
gradle
Purl
pkg:deb/ubuntu/gradle?arch=src?distro=noble

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

4.*

4.4.1-18
4.4.1-20

Ecosystem specific 

{
    "ubuntu_priority": "medium"
}