CVE-2023-26053: Gradle usage of long IDs for PGP keys opens potential for collision attacks
Gradle is a build tool with a focus on build automation and support for multi-language development. This is a collision attack on long IDs (64bits) for PGP keys. Users of dependency verification in Gradle are vulnerable if they use long IDs for PGP keys in a trusted-key or pgp element in their dependency verification metadata file. The fix is to fail dependency verification if anything but a fingerprint is used in a trust element in dependency verification metadata. The problem is fixed in Gradle 8.0 and above. The problem is also patched in Gradle 6.9.4 and 7.6.1. As a workaround, use only full fingerprint IDs for trusted-key or pgp element in the metadata is a protection against this issue.
Other sources
This is a collision attack on long IDs (64bits) for PGP keys.
Users of dependency verification in Gradle are vulnerable if they use long IDs for PGP keys in a trusted-key or pgp element in their dependency verification metadata file.
Grandle between 6.2 to 7.6 are impacted by this issue.
— Red Hat
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2023-26053?
CVE-2023-26053 is a vulnerability in Gradle, a build tool used for build automation and multi-language development.
How severe is CVE-2023-26053?
CVE-2023-26053 has a severity rating of 9.8, which is considered critical.
Who is affected by CVE-2023-26053?
Users of Gradle versions up to and including 6.9.4 and 7.6.1 are affected by CVE-2023-26053.
How can I fix CVE-2023-26053?
To fix CVE-2023-26053, update Gradle to version 6.9.4, 7.6.1, or later.
Where can I find more information about CVE-2023-26053?
You can find more information about CVE-2023-26053 on the Red Hat errata page, the Red Hat security advisory page, and the Red Hat bugzilla page.