Stay Secure with the Latest Linux Advisories

security advisoryupdatecritical

Fedora 28: FEDORA-2019-902786bc1e Critical: Gradle HTTP Security Issue

Fixes CVE-2019-11065 security vulnerability. --------------------------------------------------------------------------------Fedora Update Notification FEDORA-2019-902786bc1e 2019-05-03 01:35:16.417415 --------------------------------------------------------------------------------Name : gradle Product : Fedora 28 Version : 4.3.1 Release : 9.fc28 URL : https://gradle.org Summary : Build automation tool Description : Gradle is build automation evolved. Gradle can automate the building, testing, publishing, deployment and more of software packages or other types of projects such as generated static websites, generated documentation or indeed anything else. Gradle combines the power and flexibility of Ant with the dependency management and conventions of Maven into a more effective way to build. Powered by a Groovy DSL and packed with innovation, Gradle provides a declarative way to describe all kinds of builds through sensible defaults. Gradle is quickly becoming the build system of choice for many open source projects, leading edge enterprises and legacy automation challenges. --------------------------------------------------------------------------------Update Information: Fixes CVE-2019-11065 security vulnerability --------------------------------------------------------------------------------ChangeLog: * Wed Apr 10 2019 Mikolaj Izdebski - 4.3.1-9 - Use HTTPS for GoogleAPIs repository - Resolves: CVE-2019-11065 * Fri Jul 13 2018 Fedora Release Engineering - 4.3.1-8 - Rebuilt for https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild * Wed Apr 25 2018 Mikolaj Izdebski - 4.3.1-7 - Rebuild for objectweb-asm update * Mon Mar 26 2018 Michael Simacek - 4.3.1-6 - Bump source version to 8 to fix FTBFS - Remove unused dependency on sonar --------------------------------------------------------------------------------References: [ 1 ] Bug #1698508 - CVE-2019-11065 gradle: Insecure HTTP URL used to download dependencies leading topossibly maliciously compromised artifacts. https://bugzilla.redhat.com/show_bug.cgi?id=1698508 --------------------------------------------------------------------------------This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2019-902786bc1e' at the command line. For more information, refer to the dnf documentation available at https://dnf.readthedocs.io/en/latest/command_ref.html All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/security/ --------------------------------------------------------------------------------_______________________________________________ package-announce mailing list -- This email address is being protected from spambots. You need JavaScript enabled to view it. To unsubscribe send an email to This email address is being protected from spambots. You need JavaScript enabled to view it. Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedoraproject.org/archives/list/This email address is being protected from spambots. You need JavaScript enabled to view it./ . Mitigation for CVE-2019-11065 in Gradle incorporates secure downloading protocols to avert the risk of harmful artifacts in Fedora 28.. Gradle Update, Fedora Security, HTTP Security Fix, Dependency Management. . Severity: Critical. LinuxSecurity.com Team

May 02, 2019 •Critical Fedora