{"id":"CVE-2019-16370","details":"The PGP signing plugin in Gradle before 6.0 relies on the SHA-1 algorithm, which might allow an attacker to replace an artifact with a different one that has the same SHA-1 message digest, a related issue to CVE-2005-4900.","aliases":["GHSA-hhr2-f668-ff2w"],"modified":"2026-07-08T20:15:26.907614Z","published":"2019-09-16T18:15:12.190Z","related":["openSUSE-SU-2024:10817-1"],"references":[{"type":"FIX","url":"https://github.com/gradle/gradle/commit/425b2b7a50cd84106a77cdf1ab665c89c6b14d2f"},{"type":"FIX","url":"https://github.com/gradle/gradle/pull/10543"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/gradle/gradle","events":[{"introduced":"0"},{"fixed":"0a5b531749138f2f983f7c888fa7790bfc52d88a"},{"fixed":"425b2b7a50cd84106a77cdf1ab665c89c6b14d2f"}],"database_specific":{"source":["CPE_RANGE","REFERENCES"],"cpe":"cpe:2.3:a:gradle:gradle:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"0"},{"fixed":"6.0"}]}}],"versions":["v6.0.0-RC3","v6.0.0-RC2","v6.0.0-RC1","v3.0.0-M1","REL_3.0-milestone-1","v1.12.0-RC2","v1.12.0","v1.12-RC2","v1.12","REL_1.12-rc-2","REL_1.12","v1.12.0-RC1","v1.12-RC1","REL_1.12-rc-1","v1.11.0","v1.11","REL_1.11","v1.11.0-RC1","v1.11-RC1","REL_1.11-rc-1","v1.0.0-M3","v1.0-M3","REL_1.0-milestone-3","v1.0.0-M2","v1.0-M2","REL_1.0-milestone-2","v1.0.0-M1","v1.0-M1","REL_1.0-milestone-1","v0.9.2","REL_0.9.2","v0.9.1","REL_0.9.1","v0.9.0","v0.9","REL_0.9","v0.9.0-RC3","v0.9-RC3","REL_0.9-rc-3","v0.9.0-RC2","v0.9-RC2","REL_0.9-rc-2","v0.9.0-RC1","v0.9-RC1","REL-0.9-rc-1","REL-0.9-preview-3","REL-0.9-preview-2","REL-0.9-preview-1","v0.8.0","v0.8","REL-0.8"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2019-16370.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N"}]}