{"id":"GHSA-pprq-4488-wgqx","summary":"Insecure transport protocol in Gradle","details":"Gradle versions from 1.4 to 5.3.1 use an insecure HTTP URL to download dependencies when the built-in JavaScript or CoffeeScript Gradle plugins are used. Dependency artifacts could have been maliciously compromised by a MITM attack against the ajax.googleapis.com web site.","aliases":["CVE-2019-11065"],"modified":"2023-11-08T04:00:59.495896Z","published":"2022-05-13T01:21:57Z","database_specific":{"nvd_published_at":"2019-04-10T00:29:00Z","cwe_ids":["CWE-319"],"severity":"MODERATE","github_reviewed":true,"github_reviewed_at":"2022-11-01T23:02:27Z"},"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2019-11065"},{"type":"WEB","url":"https://github.com/gradle/gradle/pull/8927"},{"type":"PACKAGE","url":"https://github.com/gradle/gradle"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WVXOXNLAYRGPKAZV63PYNV3HF27JW2MW"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/Y43P7SVDJOG6OUDVFR4ZIDITZLNHPGTO"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YQ5CGOV5QVQCSPGE3WRZDKUGIXLHSZDR"}],"affected":[{"package":{"name":"org.gradle:gradle-core","ecosystem":"Maven","purl":"pkg:maven/org.gradle/gradle-core"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.4"},{"fixed":"5.4.0"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-pprq-4488-wgqx/GHSA-pprq-4488-wgqx.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N"}]}