by @LeSuisse Activity log
- Created suggestion
-
@LeSuisse
ignored
6 packages
- gradle-completion
- gradle_7-unwrapped
- gradle_8-unwrapped
- gradle_9-unwrapped
- gradle-dependency-tree-diff
- vscode-extensions.vscjava.vscode-gradle
- @LeSuisse accepted
- @LeSuisse published on GitHub
Gradle's failure to disable repositories failing to answer can expose builds to malicious artifacts
Gradle is a build automation tool, and its native-platform tool provides Java bindings for native APIs. When resolving dependencies in versions before 9.3.0, some exceptions were not treated as fatal errors and would not cause a repository to be disabled. If a build encountered one of these exceptions, Gradle would continue to the next repository in the list and potentially resolve dependencies from a different repository. An exception like NoHttpResponseException can indicate transient errors. If the errors persist after a maximum number of retries, Gradle would continue to the next repository. This behavior could allow an attacker to disrupt the service of a repository and leverage another repository to serve malicious artifacts. This attack requires the attacker to have control over a repository after the disrupted repository. Gradle has introduced a change in behavior in Gradle 9.3.0 to stop searching other repositories when encountering these errors.
References
-
https://github.com/gradle/gradle/security/advisories/GHSA-mqwm-5m85-gmcv x_refsource_CONFIRM
Affected products
- ==< 9.3.0
Matching in nixpkgs
Ignored packages (6)
pkgs.gradle-completion
Gradle tab completion for bash and zsh
pkgs.gradle_7-unwrapped
Enterprise-grade build system
pkgs.gradle_8-unwrapped
Enterprise-grade build system
pkgs.gradle_9-unwrapped
Enterprise-grade build system
pkgs.gradle-dependency-tree-diff
Intelligent diff tool for the output of Gradle's dependencies task
pkgs.vscode-extensions.vscjava.vscode-gradle
Visual Studio Code extension for Gradle build tool
Package maintainers
-
@chayleaf Anna Pavlyuk <chayleaf-nix@pavluk.org>
-
@FliegendeWurst Arne Keller <arne.keller@posteo.de>
-
@liff Olli Helenius <liff@iki.fi>
-
@Infinidoge Infinidoge <infinidoge@inx.moe>
-
@tomodachi94 Tomodachi94 <tomodachi94@protonmail.com>
-
@lorenzleutgeb Lorenz Leutgeb <lorenz@leutgeb.xyz>
-
@msgilligan Sean Gilligan <sean@msgilligan.com>
-
@britter Benedikt Ritter <beneritter@gmail.com>