CVE-2023-35946: Path Traversal
First published: Fri Jun 30 2023(Updated: )
Gradle is a build tool with a focus on build automation and support for multi-language development. When Gradle writes a dependency into its dependency cache, it uses the dependency's coordinates to compute a file location. With specially crafted dependency coordinates, Gradle can be made to write files into an unintended location. The file may be written outside the dependency cache or over another file in the dependency cache. This vulnerability could be used to poison the dependency cache or overwrite important files elsewhere on the filesystem where the Gradle process has write permissions. Exploiting this vulnerability requires an attacker to have control over a dependency repository used by the Gradle build or have the ability to modify the build's configuration. It is unlikely that this would go unnoticed. A fix has been released in Gradle 7.6.2 and 8.2 to protect against this vulnerability. Gradle will refuse to cache dependencies that have path traversal elements in their dependency coordinates. It is recommended that users upgrade to a patched version. If you are unable to upgrade to Gradle 7.6.2 or 8.2, `dependency verification` will make this vulnerability more difficult to exploit.
Credit: security-advisories@github.com security-advisories@github.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Gradle Gradle | <7.6.2 | |
| Gradle Gradle | >=8.0<8.2 | |
| Gradle Gradle | >=8.0.0<8.2.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://docs.gradle.org/current/userguide/dependency_verification.html
- https://github.com/gradle/gradle/commit/859eae2b2acf751ae7db3c9ffefe275aa5da0d5d
- https://github.com/gradle/gradle/commit/b07e528feb3a5ffa66bdcc358549edd73e4c8a12
- https://github.com/gradle/gradle/security/advisories/GHSA-2h6c-rv6q-494v
- https://security.netapp.com/advisory/ntap-20230731-0003/
Frequently Asked Questions
What is CVE-2023-35946?
CVE-2023-35946 is a vulnerability in Gradle that allows an attacker to write files to arbitrary locations on the file system.
What is the severity of CVE-2023-35946?
The severity of CVE-2023-35946 is medium with a severity value of 5.5.
How does CVE-2023-35946 affect Gradle?
CVE-2023-35946 affects Gradle versions up to and excluding 7.6.2, as well as versions from 8.0 up to and excluding 8.2.
How can an attacker exploit CVE-2023-35946?
An attacker can exploit CVE-2023-35946 by using specially crafted dependency coordinates to trick Gradle into writing files to arbitrary locations on the file system.
Is there a fix for CVE-2023-35946?
Yes, the fix for CVE-2023-35946 is included in Gradle versions 7.6.2 and 8.2. It is recommended to upgrade to these versions or later to mitigate the vulnerability.
- collector/nvd-index
- agent/author
- agent/type
- agent/remedy
- agent/first-publish-date
- agent/last-modified-date
- agent/weakness
- agent/severity
- agent/softwarecombine
- agent/references
- agent/description
- agent/tags
- agent/event
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/gradle
- canonical/gradle gradle
- version/gradle gradle/8.0
- version/gradle gradle/8.0.0