VDB
CVE-2023-26053
CVE-2023-26053
PUBLISHED
CVSS 9.800000190734863 CRITICAL
Gradle is a build tool with a focus on build automation and support for multi-language development. This is a collision attack on long IDs (64bits) for PGP keys. Users of dependency verification in Gradle are vulnerable if they use long IDs for PGP keys in a `trusted-key` or `pgp` element in their dependency verification metadata file. The fix is to fail dependency verification if anything but a fingerprint is used in a trust element in dependency verification metadata. The problem is fixed in Gradle 8.0 and above. The problem is also patched in Gradle 6.9.4 and 7.6.1. As a workaround, use only full fingerprint IDs for `trusted-key` or `pgp` element in the metadata is a protection against this issue.
EPSS 1.00% · 60.4th percentile
Risk Scores
CVSS 3.1
9.800000190734863
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score
1.00%
60.4th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Bitnami | gradle | 6.2.0, 7.0.0 |
| Bitnami | gradle | 6.2.0, 7.0.0 |
Timeline
- Feb 28, 2023 CVE Published
- Mar 2, 2023 EPSS Score
- Mar 2, 2023 PoC Published
- Mar 7, 2023 EPSS Score
- Apr 10, 2023 EPSS Score
- May 20, 2023 EPSS Score
- Jun 28, 2023 EPSS Score
- Sep 15, 2023 EPSS Score
- Oct 24, 2023 EPSS Score
- Dec 2, 2023 EPSS Score
- Jan 10, 2024 EPSS Score
- Feb 19, 2024 EPSS Score