CVE-2020-7599
First published: Mon Mar 30 2020(Updated: )
All versions of com.gradle.plugin-publish before 0.11.0 are vulnerable to Insertion of Sensitive Information into Log File. When a plugin author publishes a Gradle plugin while running Gradle with the --info log level flag, the Gradle Logger logs an AWS pre-signed URL. If this build log is publicly visible (as it is in many popular public CI systems like TravisCI) this AWS pre-signed URL would allow a malicious actor to replace a recently uploaded plugin with their own.
Credit: report@snyk.io
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Gradle Plugin Publishing | <0.11.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is CVE-2020-7599?
CVE-2020-7599 is a vulnerability that affects all versions of com.gradle.plugin-publish before 0.11.0.
What is the severity of CVE-2020-7599?
CVE-2020-7599 has a severity level of 6.5 (medium).
How does CVE-2020-7599 affect Gradle Plugin Publishing?
CVE-2020-7599 allows for the insertion of sensitive information into the log file during the publishing of a Gradle plugin.
How can I fix CVE-2020-7599?
To fix CVE-2020-7599, update com.gradle.plugin-publish to version 0.11.0 or higher.
Where can I find more information about CVE-2020-7599?
You can find more information about CVE-2020-7599 at the following references: [https://blog.gradle.org/plugin-portal-update](https://blog.gradle.org/plugin-portal-update) and [https://snyk.io/vuln/SNYK-JAVA-COMGRADLEPLUGINPUBLISH-559866](https://snyk.io/vuln/SNYK-JAVA-COMGRADLEPLUGINPUBLISH-559866).
- collector/nvd-index
- agent/author
- agent/severity
- agent/references
- agent/weakness
- agent/description
- agent/type
- agent/last-modified-date
- agent/softwarecombine
- agent/first-publish-date
- agent/event
- agent/tags
- collector/mitre-cve
- source/MITRE
- vendor/gradle
- canonical/gradle plugin publishing