bugtraq - CVE-2017-3160: Gradle Distribution URL used by Cordova-Android does not use https by default

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: Fri, 27 Jan 2017 23:36:19 GMT
From: bowserj@...il.com
To: bugtraq@...urityfocus.com
Subject: CVE-2017-3160: Gradle Distribution URL used by Cordova-Android
 does not use https by default

===================================================================
CVE-2017-3160: Gradle Distribution URL used by Cordova-Android does not use https by default

Severity: High

Vendor: The Apache Software Foundation

Versions Affected: Cordova Android (6.1.1 and below)

Description: After the Android platform is added to Cordova the first time, or after a project is created using the build scripts, the scripts will fetch Gradle on the first build. However, since the default URI is not using https, it is vulnerable to a MiTM and the Gradle executable is not safe. The severity of this issue is high due to the fact that the build scripts immediately start a build after Gradle has been fetched.

Upgrade path: Developers who are concerned about this issue should install version 6.1.2 or higher of Cordova-Android.

Mitigation Steps: If developers are unable to install the latest version, this vulnerability can easily be mitigated by setting the CORDOVA_ANDROID_GRADLE_DISTRIBUTION_URL environment variable to https://services.gradle.org/distributions/gradle-2.14.1-all.zip

Credit: Alon Galili