CVE-2019-16370: Medium severity gradle vulnerability
Published Sep 16, 2019
·Updated
The PGP signing plugin in Gradle before 6.0 relies on the SHA-1 algorithm, which might allow an attacker to replace an artifact with a different one that has the same SHA-1 message digest, a related issue to CVE-2005-4900.
Affected Software
1 affected component
gradle Gradle<6.0
Remediation
Patch Available
Event History
Sep 16, 2019
CVE Published
via MITRE·05:50 PM
Data Sourced
via MITRE·05:50 PM
Description
Frequently Asked Questions
1
What is CVE-2019-16370?
CVE-2019-16370 is a vulnerability in the PGP signing plugin in Gradle before version 6.0.
2
What is the severity of CVE-2019-16370?
CVE-2019-16370 has a severity level of medium with a CVSS score of 5.9.
3
How does CVE-2019-16370 affect Gradle?
CVE-2019-16370 affects Gradle versions up to and excluding 6.0.
4
What is the impact of CVE-2019-16370?
CVE-2019-16370 could allow an attacker to replace an artifact with a different one that has the same SHA-1 message digest.
5
How can I fix CVE-2019-16370?
To fix CVE-2019-16370, upgrade to Gradle version 6.0 or later.