CVE-2019-15052
gradle: sends authentication credentials originally destined for the configured host
Severity by source
Trivy's own label is CRITICAL. Rated critical by NVD. Rated lower by Red Hat (high), Ubuntu (medium).
Description
The HTTP client in Gradle before 5.6 sends authentication credentials originally destined for the configured host. If that host returns a 30x redirect, Gradle also sends those credentials to all subsequent hosts that the request redirects to. This is similar to CVE-2018-1000007.
Affected packages and fixed versions
| Source | Package | Fixed in |
|---|---|---|
| debian 10 | gradle | no fix listed |
| debian 11 | gradle | no fix listed |
| debian 12 | gradle | no fix listed |
| debian 13 | gradle | no fix listed |
| debian 14 | gradle | no fix listed |
| debian 8 | gradle | no fix listed |
| debian 9 | gradle | no fix listed |
| echo | gradle | no fix listed |
| rapidfort debian 12 | gradle | no fix listed |
| rapidfort debian 13 | gradle | no fix listed |
| rapidfort ubuntu 20.04 | gradle | no fix listed |
| rapidfort ubuntu 22.04 | gradle | no fix listed |
Show all 19 entries from 19 sources
| Source | Package | Fixed in |
|---|---|---|
| debian 10 | gradle | no fix listed |
| debian 11 | gradle | no fix listed |
| debian 12 | gradle | no fix listed |
| debian 13 | gradle | no fix listed |
| debian 14 | gradle | no fix listed |
| debian 8 | gradle | no fix listed |
| debian 9 | gradle | no fix listed |
| echo | gradle | no fix listed |
| rapidfort debian 12 | gradle | no fix listed |
| rapidfort debian 13 | gradle | no fix listed |
| rapidfort ubuntu 20.04 | gradle | no fix listed |
| rapidfort ubuntu 22.04 | gradle | no fix listed |
| rapidfort ubuntu 24.04 | gradle | no fix listed |
| ubuntu 18.04-ESM | gradle | no fix listed |
| ubuntu 20.04-ESM | gradle | no fix listed |
| ubuntu 22.04 | gradle | no fix listed |
| ubuntu 24.04 | gradle | no fix listed |
| ubuntu 26.04 | gradle | no fix listed |
| ubuntu 26.10 | gradle | no fix listed |
References
- https://access.redhat.com/security/cve/CVE-2019-15052
- https://github.com/gradle/gradle/issues/10278
- https://github.com/gradle/gradle/pull/10176
- https://github.com/gradle/gradle/security/advisories/GHSA-4cwg-f7qc-6r95
- https://nvd.nist.gov/vuln/detail/CVE-2019-15052
- https://www.cve.org/CVERecord?id=CVE-2019-15052