Gradle's failure to disable repositories failing to answer can expose builds to malicious artifacts
Gradle is a build automation tool, and its native-platform tool provides Java bindings for native APIs. When resolving dependencies in versions before 9.3.0, some exceptions were not treated as fatal errors and would not cause a repository to be disabled. If a build encountered one of these exceptions, Gradle would continue to the next repository in the list and potentially resolve dependencies from a different repository. An exception like NoHttpResponseException can indicate transient errors. If the errors persist after a maximum number of retries, Gradle would continue to the next repository. This behavior could allow an attacker to disrupt the service of a repository and leverage another repository to serve malicious artifacts. This attack requires the attacker to have control over a repository after the disrupted repository. Gradle has introduced a change in behavior in Gradle 9.3.0 to stop searching other repositories when encountering these errors.
References
-
https://github.com/gradle/gradle/security/advisories/GHSA-mqwm-5m85-gmcv x_refsource_CONFIRM
Affected products
- ==< 9.3.0
Matching in nixpkgs
pkgs.gradle_7
Enterprise-grade build system
pkgs.gradle_8
Enterprise-grade build system
pkgs.gradle-completion
Gradle tab completion for bash and zsh
pkgs.gradle_7-unwrapped
Enterprise-grade build system
pkgs.gradle_8-unwrapped
Enterprise-grade build system
pkgs.gradle_9-unwrapped
Enterprise-grade build system
pkgs.gradle-dependency-tree-diff
Intelligent diff tool for the output of Gradle's dependencies task
pkgs.vscode-extensions.vscjava.vscode-gradle
Visual Studio Code extension for Gradle build tool
-
nixos-unstable 3.16.2024111106
- nixpkgs-unstable 3.16.2024111106
- nixos-unstable-small 3.16.2024111106
Package maintainers
-
@chayleaf Anna Pavlyuk <chayleaf-nix@pavluk.org>
-
@Infinidoge Infinidoge <infinidoge@inx.moe>
-
@FliegendeWurst Arne Keller <arne.keller@posteo.de>
-
@liff Olli Helenius <liff@iki.fi>
-
@lorenzleutgeb Lorenz Leutgeb <lorenz@leutgeb.xyz>
-
@tomodachi94 Tomodachi94 <tomodachi94@protonmail.com>
-
@britter Benedikt Ritter <beneritter@gmail.com>
-
@JarvisCraft Petr Portnov <mrjarviscraft+nix@gmail.com>
-
@rhoriguchi Ryan Horiguchi <ryan.horiguchi@gmail.com>
-
@msgilligan Sean Gilligan <sean@msgilligan.com>