CVE-2020-7599: Medium severity Gradle Plugin Publishing vulnerability
All versions of com.gradle.plugin-publish before 0.11.0 are vulnerable to Insertion of Sensitive Information into Log File. When a plugin author publishes a Gradle plugin while running Gradle with the --info log level flag, the Gradle Logger logs an AWS pre-signed URL. If this build log is publicly visible (as it is in many popular public CI systems like TravisCI) this AWS pre-signed URL would allow a malicious actor to replace a recently uploaded plugin with their own.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
com.gradle.plugin-publishto a version that resolves this vulnerability.Fixed in 0.11.0 - Configuration
When publishing a plugin, avoid running Gradle with the --info log level flag to prevent logging an AWS pre-signed URL to the build logs.
Gradle (plugin publication with plugin-publish) log level = not --info - Compensating control
Ensure build logs (including Gradle plugin-publish output) are not publicly visible (e.g., restrict access to private CI system logs) to prevent exposure of the AWS pre-signed URL.
Event History
Frequently Asked Questions
What is CVE-2020-7599?
CVE-2020-7599 is a vulnerability that affects all versions of com.gradle.plugin-publish before 0.11.0.
What is the severity of CVE-2020-7599?
CVE-2020-7599 has a severity level of 6.5 (medium).
How does CVE-2020-7599 affect Gradle Plugin Publishing?
CVE-2020-7599 allows for the insertion of sensitive information into the log file during the publishing of a Gradle plugin.
How can I fix CVE-2020-7599?
To fix CVE-2020-7599, update com.gradle.plugin-publish to version 0.11.0 or higher.
Where can I find more information about CVE-2020-7599?
You can find more information about CVE-2020-7599 at the following references: [https://blog.gradle.org/plugin-portal-update](https://blog.gradle.org/plugin-portal-update) and [https://snyk.io/vuln/SNYK-JAVA-COMGRADLEPLUGINPUBLISH-559866](https://snyk.io/vuln/SNYK-JAVA-COMGRADLEPLUGINPUBLISH-559866).