[Bug 1698510] New: CVE-2019-11065 gradle: Insecure HTTP URL used to download dependencies leading to possibly maliciously compromised artifacts. [fedora-29]
9:04 a.m.
https://bugzilla.redhat.com/show_bug.cgi?id=1698510
Bug ID: 1698510
Summary: CVE-2019-11065 gradle: Insecure HTTP URL used to
download dependencies leading to possibly maliciously
compromised artifacts. [fedora-29]
Product: Fedora
Version: 29
Status: NEW
Component: gradle
Keywords: Security, SecurityTracking
Severity: high
Priority: high
Assignee: stewardship-sig(a)lists.fedoraproject.org
Reporter: mrehak(a)redhat.com
QA Contact: extras-qa(a)fedoraproject.org
CC: dan(a)danieljamesscott.org,
java-sig-commits(a)lists.fedoraproject.org,
jjelen(a)redhat.com, lkundrak(a)v3.sk,
mizdebsk(a)redhat.com,
stewardship-sig(a)lists.fedoraproject.org
Target Milestone: ---
Classification: Fedora
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of fedora-29.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks"
field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
--
You are receiving this mail because:
You are on the CC list for the bug.
9:04 a.m.
New subject: [Bug 1698510] CVE-2019-11065 gradle: Insecure HTTP URL used to download dependencies leading to possibly maliciously compromised artifacts. [fedora-29]
https://bugzilla.redhat.com/show_bug.cgi?id=1698510
--- Comment #1 from Marian Rehak <mrehak(a)redhat.com> ---
Use the following template to for the 'fedpkg update' request to submit an
update for this issue as it contains the top-level parent bug(s) as well as
this tracking bug. This will ensure that all associated bugs get updated
when new packages are pushed to stable.
=====
# bugfix, security, enhancement, newpackage (required)
type=security
# low, medium, high, urgent (required)
severity=high
# testing, stable
request=testing
# Bug numbers: 1234,9876
bugs=1698508,1698510
# Description of your update
notes=Security fix for [PUT CVEs HERE]
# Enable request automation based on the stable/unstable karma thresholds
autokarma=True
stable_karma=3
unstable_karma=-3
# Automatically close bugs when this marked as stable
close_bugs=True
# Suggest that users restart after update
suggest_reboot=False
======
Additionally, you may opt to use the bodhi web interface to submit updates:
https://bodhi.fedoraproject.org/updates/new
--
You are receiving this mail because:
You are on the CC list for the bug.
9:04 a.m.
New subject: [Bug 1698510] CVE-2019-11065 gradle: Insecure HTTP URL used to download dependencies leading to possibly maliciously compromised artifacts. [fedora-29]
https://bugzilla.redhat.com/show_bug.cgi?id=1698510
Marian Rehak <mrehak(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Blocks| |1698508 (CVE-2019-11065)
Referenced Bugs:
https://bugzilla.redhat.com/show_bug.cgi?id=1698508
[Bug 1698508] CVE-2019-11065 gradle: Insecure HTTP URL used to download
dependencies leading to possibly maliciously compromised artifacts.
--
You are receiving this mail because:
You are on the CC list for the bug.
10:12 a.m.
New subject: [Bug 1698510] CVE-2019-11065 gradle: Insecure HTTP URL used to download dependencies leading to possibly maliciously compromised artifacts. [fedora-29]
https://bugzilla.redhat.com/show_bug.cgi?id=1698510
Mikolaj Izdebski <mizdebsk(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Status|NEW |ASSIGNED
Assignee|stewardship-sig(a)lists.fedor |mizdebsk(a)redhat.com
|aproject.org |
--
You are receiving this mail because:
You are on the CC list for the bug.
10:32 a.m.
New subject: [Bug 1698510] CVE-2019-11065 gradle: Insecure HTTP URL used to download dependencies leading to possibly maliciously compromised artifacts. [fedora-29]
https://bugzilla.redhat.com/show_bug.cgi?id=1698510
Mikolaj Izdebski <mizdebsk(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Depends On| |1675056, 1657836
Fixed In Version| |gradle-4.3.1-9.fc29
Flags| |needinfo?(stewardship-sig@l
| |ists.fedoraproject.org)
--- Comment #2 from Mikolaj Izdebski <mizdebsk(a)redhat.com> ---
I've commited fixes for Fedora 28 and 29.
Fedora 30 and rawhide are blocked on FTBFS.
Referenced Bugs:
https://bugzilla.redhat.com/show_bug.cgi?id=1657836
[Bug 1657836] gradle: FTBFS in Fedora rawhide
https://bugzilla.redhat.com/show_bug.cgi?id=1675056
[Bug 1675056] gradle: FTBFS in Fedora rawhide/f30
--
You are receiving this mail because:
You are on the CC list for the bug.
10:32 a.m.
New subject: [Bug 1698510] CVE-2019-11065 gradle: Insecure HTTP URL used to download dependencies leading to possibly maliciously compromised artifacts. [fedora-29]
https://bugzilla.redhat.com/show_bug.cgi?id=1698510
Mikolaj Izdebski <mizdebsk(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Status|ASSIGNED |MODIFIED
--
You are receiving this mail because:
You are on the CC list for the bug.
10:34 a.m.
New subject: [Bug 1698510] CVE-2019-11065 gradle: Insecure HTTP URL used to download dependencies leading to possibly maliciously compromised artifacts. [fedora-29]
https://bugzilla.redhat.com/show_bug.cgi?id=1698510
Fabio Valentini <decathorpe(a)gmail.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
CC| |decathorpe(a)gmail.com
--- Comment #3 from Fabio Valentini <decathorpe(a)gmail.com> ---
I suspect the Stewardship SIG will talk about the f30/rawhide situation during
our next meeting.
--
You are receiving this mail because:
You are on the CC list for the bug.
12:33 p.m.
New subject: [Bug 1698510] CVE-2019-11065 gradle: Insecure HTTP URL used to download dependencies leading to possibly maliciously compromised artifacts. [fedora-29]
https://bugzilla.redhat.com/show_bug.cgi?id=1698510
--- Comment #4 from Mikolaj Izdebski <mizdebsk(a)redhat.com> ---
Build failed on ARM32 with OOM:
https://koji.fedoraproject.org/koji/taskinfo?taskID=34101529
I'll try to resubmit it until I hit a 64-bit builder.
--
You are receiving this mail because:
You are on the CC list for the bug.
12:42 p.m.
New subject: [Bug 1698510] CVE-2019-11065 gradle: Insecure HTTP URL used to download dependencies leading to possibly maliciously compromised artifacts. [fedora-29]
https://bugzilla.redhat.com/show_bug.cgi?id=1698510
--- Comment #5 from Fedora Update System <updates(a)fedoraproject.org> ---
gradle-4.3.1-9.fc29 has been submitted as an update to Fedora 29.
https://bodhi.fedoraproject.org/updates/FEDORA-2019-a9c15101fb
--
You are receiving this mail because:
You are on the CC list for the bug.
10:56 p.m.
New subject: [Bug 1698510] CVE-2019-11065 gradle: Insecure HTTP URL used to download dependencies leading to possibly maliciously compromised artifacts. [fedora-29]
https://bugzilla.redhat.com/show_bug.cgi?id=1698510
Fedora Update System <updates(a)fedoraproject.org> changed:
What |Removed |Added
----------------------------------------------------------------------------
Status|MODIFIED |ON_QA
--- Comment #6 from Fedora Update System <updates(a)fedoraproject.org> ---
gradle-4.3.1-9.fc29 has been pushed to the Fedora 29 testing repository. If
problems still persist, please make note of it in this bug report.
See https://fedoraproject.org/wiki/QA:Updates_Testing for
instructions on how to install test updates.
You can provide feedback for this update here:
https://bodhi.fedoraproject.org/updates/FEDORA-2019-a9c15101fb
--
You are receiving this mail because:
You are on the CC list for the bug.
4:09 a.m.
New subject: [Bug 1698510] CVE-2019-11065 gradle: Insecure HTTP URL used to download dependencies leading to possibly maliciously compromised artifacts. [fedora-29]
https://bugzilla.redhat.com/show_bug.cgi?id=1698510
Bug 1698510 depends on bug 1675056, which changed state.
Bug 1675056 Summary: gradle: FTBFS in Fedora rawhide/f30
https://bugzilla.redhat.com/show_bug.cgi?id=1675056
What |Removed |Added
----------------------------------------------------------------------------
Status|NEW |CLOSED
Resolution|--- |DUPLICATE
--
You are receiving this mail because:
You are on the CC list for the bug.
9:20 p.m.
New subject: [Bug 1698510] CVE-2019-11065 gradle: Insecure HTTP URL used to download dependencies leading to possibly maliciously compromised artifacts. [fedora-29]
https://bugzilla.redhat.com/show_bug.cgi?id=1698510
--- Comment #7 from Fedora Update System <updates(a)fedoraproject.org> ---
gradle-4.3.1-9.fc29 has been pushed to the Fedora 29 stable repository. If
problems still persist, please make note of it in this bug report.
--
You are receiving this mail because:
You are on the CC list for the bug.
8:25 a.m.
New subject: [Bug 1698510] CVE-2019-11065 gradle: Insecure HTTP URL used to download dependencies leading to possibly maliciously compromised artifacts. [fedora-29]
https://bugzilla.redhat.com/show_bug.cgi?id=1698510
Bug 1698510 depends on bug 1657836, which changed state.
Bug 1657836 Summary: gradle: FTBFS in Fedora rawhide
https://bugzilla.redhat.com/show_bug.cgi?id=1657836
What |Removed |Added
----------------------------------------------------------------------------
Status|ASSIGNED |CLOSED
Resolution|--- |WORKSFORME
--
You are receiving this mail because:
You are on the CC list for the bug.
9:59 a.m.
New subject: [Bug 1698510] CVE-2019-11065 gradle: Insecure HTTP URL used to download dependencies leading to possibly maliciously compromised artifacts. [fedora-29]
https://bugzilla.redhat.com/show_bug.cgi?id=1698510
Bug 1698510 depends on bug 1657836, which changed state.
Bug 1657836 Summary: gradle: FTBFS in Fedora rawhide
https://bugzilla.redhat.com/show_bug.cgi?id=1657836
What |Removed |Added
----------------------------------------------------------------------------
Status|CLOSED |ASSIGNED
Resolution|WORKSFORME |---
--
You are receiving this mail because:
You are on the CC list for the bug.
5:08 a.m.
New subject: [Bug 1698510] CVE-2019-11065 gradle: Insecure HTTP URL used to download dependencies leading to possibly maliciously compromised artifacts. [fedora-29]
https://bugzilla.redhat.com/show_bug.cgi?id=1698510
Mikolaj Izdebski <mizdebsk(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Status|ON_QA |NEW
Version|29 |30
Assignee|mizdebsk(a)redhat.com |stewardship-sig(a)lists.fedor
| |aproject.org
--- Comment #8 from Mikolaj Izdebski <mizdebsk(a)redhat.com> ---
Fedora 28 and 29 were fixed in version 4.3.1 release 9, but Fedora 30 and later
are still vulnerable.
I'm reassigning the bug to package owner since I don't maintain Gradle in
affected Fedora versions.
--
You are receiving this mail because:
You are on the CC list for the bug.
9:31 a.m.
New subject: [Bug 1698510] CVE-2019-11065 gradle: Insecure HTTP URL used to download dependencies leading to possibly maliciously compromised artifacts. [fedora-29]
https://bugzilla.redhat.com/show_bug.cgi?id=1698510
Miro Hrončok <mhroncok(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
CC| |mhroncok(a)redhat.com
--- Comment #9 from Miro Hrončok <mhroncok(a)redhat.com> ---
Oh I thought we did this when we rebuilt gradle :(
We should really at least do it in F30.
--
You are receiving this mail because:
You are on the CC list for the bug.
9:51 a.m.
New subject: [Bug 1698510] CVE-2019-11065 gradle: Insecure HTTP URL used to download dependencies leading to possibly maliciously compromised artifacts. [fedora-29]
https://bugzilla.redhat.com/show_bug.cgi?id=1698510
Fabio Valentini <decathorpe(a)gmail.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Status|NEW |ASSIGNED
--- Comment #10 from Fabio Valentini <decathorpe(a)gmail.com> ---
I'll try to work on this later.
Miro, do you remember which version of gradle I would have to submit as
buildroot override to actually build the patched version?
--
You are receiving this mail because:
You are on the CC list for the bug.
10:01 a.m.
New subject: [Bug 1698510] CVE-2019-11065 gradle: Insecure HTTP URL used to download dependencies leading to possibly maliciously compromised artifacts. [fedora-29]
https://bugzilla.redhat.com/show_bug.cgi?id=1698510
--- Comment #11 from Miro Hrončok <mhroncok(a)redhat.com> ---
gradle-4.3.1-8.fc29
--
You are receiving this mail because:
You are on the CC list for the bug.
3:46 p.m.
New subject: [Bug 1698510] CVE-2019-11065 gradle: Insecure HTTP URL used to download dependencies leading to possibly maliciously compromised artifacts. [fedora-29]
https://bugzilla.redhat.com/show_bug.cgi?id=1698510
--- Comment #12 from Fabio Valentini <decathorpe(a)gmail.com> ---
It looks like that trick doesn't work in released fedora:
Invalid build. It must be tagged as either candidate or testing.
:(
--
You are receiving this mail because:
You are on the CC list for the bug.
4:55 p.m.
New subject: [Bug 1698510] CVE-2019-11065 gradle: Insecure HTTP URL used to download dependencies leading to possibly maliciously compromised artifacts. [fedora-29]
https://bugzilla.redhat.com/show_bug.cgi?id=1698510
--- Comment #13 from Miro Hrončok <mhroncok(a)redhat.com> ---
https://bugzilla.redhat.com/show_bug.cgi?id=1657836#c3
Possible workaround:
Tag gradle-4.3.1 into rawhide before building newver version of gradle.
$ koji tag-build f31-pending gradle-4.3.1-8.fc29
$ koji wait-repo f31-build --build=gradle-4.3.1-8.fc29
$ fedpkg build
For F30:
$ koji tag-build f30-updates-candidate gradle-4.3.1-8.fc29
$ bodhi overrides save gradle-4.3.1-8.fc29 --wait
$ fedpkg build
--
You are receiving this mail because:
You are on the CC list for the bug.
4:55 p.m.
New subject: [Bug 1698510] CVE-2019-11065 gradle: Insecure HTTP URL used to download dependencies leading to possibly maliciously compromised artifacts. [fedora-29]
https://bugzilla.redhat.com/show_bug.cgi?id=1698510
--- Comment #14 from Miro Hrončok <mhroncok(a)redhat.com> ---
https://bodhi.fedoraproject.org/overrides/gradle-4.3.1-8.fc29
--
You are receiving this mail because:
You are on the CC list for the bug.
4:56 p.m.
New subject: [Bug 1698510] CVE-2019-11065 gradle: Insecure HTTP URL used to download dependencies leading to possibly maliciously compromised artifacts. [fedora-29]
https://bugzilla.redhat.com/show_bug.cgi?id=1698510
--- Comment #15 from Miro Hrončok <mhroncok(a)redhat.com> ---
$ koji tag-build f31-pending gradle-4.3.1-8.fc29 --force
Created task 36893514
Watching tasks (this may be safely interrupted)...
36893514 tagBuild (noarch): open (buildvm-29.phx2.fedoraproject.org)
36893514 tagBuild (noarch): open (buildvm-29.phx2.fedoraproject.org) -> closed
0 free 0 open 1 done 0 failed
36893514 tagBuild (noarch) completed successfully
--
You are receiving this mail because:
You are on the CC list for the bug.
8:59 p.m.
New subject: [Bug 1698510] CVE-2019-11065 gradle: Insecure HTTP URL used to download dependencies leading to possibly maliciously compromised artifacts. [fedora-29]
https://bugzilla.redhat.com/show_bug.cgi?id=1698510
Fedora Update System <updates(a)fedoraproject.org> changed:
What |Removed |Added
----------------------------------------------------------------------------
Status|ASSIGNED |MODIFIED
--- Comment #16 from Fedora Update System <updates(a)fedoraproject.org> ---
FEDORA-2019-1b6383acdd has been submitted as an update to Fedora 30.
https://bodhi.fedoraproject.org/updates/FEDORA-2019-1b6383acdd
--
You are receiving this mail because:
You are on the CC list for the bug.
9:01 p.m.
New subject: [Bug 1698510] CVE-2019-11065 gradle: Insecure HTTP URL used to download dependencies leading to possibly maliciously compromised artifacts. [fedora-29]
https://bugzilla.redhat.com/show_bug.cgi?id=1698510
Fabio Valentini <decathorpe(a)gmail.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Status|MODIFIED |ASSIGNED
--- Comment #17 from Fabio Valentini <decathorpe(a)gmail.com> ---
Thanks Miro, you're a Hero :+1:
The patched version is submitted to fedora 30, but I can't actually update it
on rawhide because of unresolved dependencies. And honestly I don't care about
gradle anymore, since it's probably going to be retired soon.
--
You are receiving this mail because:
You are on the CC list for the bug.
9:20 p.m.
New subject: [Bug 1698510] CVE-2019-11065 gradle: Insecure HTTP URL used to download dependencies leading to possibly maliciously compromised artifacts. [fedora-29]
https://bugzilla.redhat.com/show_bug.cgi?id=1698510
Fedora Update System <updates(a)fedoraproject.org> changed:
What |Removed |Added
----------------------------------------------------------------------------
Status|ASSIGNED |ON_QA
--- Comment #18 from Fedora Update System <updates(a)fedoraproject.org> ---
gradle-4.4.1-4.fc30 has been pushed to the Fedora 30 testing repository. If
problems still persist, please make note of it in this bug report.
See https://fedoraproject.org/wiki/QA:Updates_Testing for
instructions on how to install test updates.
You can provide feedback for this update here:
https://bodhi.fedoraproject.org/updates/FEDORA-2019-1b6383acdd
--
You are receiving this mail because:
You are on the CC list for the bug.
10:09 a.m.
New subject: [Bug 1698510] CVE-2019-11065 gradle: Insecure HTTP URL used to download dependencies leading to possibly maliciously compromised artifacts. [fedora-29]
https://bugzilla.redhat.com/show_bug.cgi?id=1698510
Bug 1698510 depends on bug 1657836, which changed state.
Bug 1657836 Summary: gradle: FTBFS in Fedora rawhide
https://bugzilla.redhat.com/show_bug.cgi?id=1657836
What |Removed |Added
----------------------------------------------------------------------------
Status|ASSIGNED |CLOSED
Resolution|--- |WONTFIX
--
You are receiving this mail because:
You are on the CC list for the bug.
8:01 p.m.
New subject: [Bug 1698510] CVE-2019-11065 gradle: Insecure HTTP URL used to download dependencies leading to possibly maliciously compromised artifacts. [fedora-29]
https://bugzilla.redhat.com/show_bug.cgi?id=1698510
Fedora Update System <updates(a)fedoraproject.org> changed:
What |Removed |Added
----------------------------------------------------------------------------
Status|ON_QA |CLOSED
Fixed In Version|gradle-4.3.1-9.fc29 |gradle-4.3.1-9.fc29
| |gradle-4.4.1-4.fc30
Resolution|--- |ERRATA
Last Closed| |2019-08-19 01:01:55
--- Comment #19 from Fedora Update System <updates(a)fedoraproject.org> ---
gradle-4.4.1-4.fc30 has been pushed to the Fedora 30 stable repository. If
problems still persist, please make note of it in this bug report.
--
You are receiving this mail because:
You are on the CC list for the bug.
1705
days inactive
1836
days old
java-sig-commits@lists.fedoraproject.org
26 comments
1 participants
participants (1)
-
bugzilla＠redhat.com