Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2021-29427— Repository content filters do not work in Settings pluginManagement

Quick assessment

Affected
gradle gradle
Exploitation
Public or AI PoC available; prioritize validation
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Gradle是美国Gradle公司的一套基于JVM的项目构建工具，它支持maven、Ivy仓库等。 Gradle 5.1版及7.0版之前存在安全漏洞，该漏洞可能导致信息泄露和/或依赖项中毒。

CVSS 8.0 · High EPSS 1.31% · P70
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2021-29427

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Repository content filters do not work in Settings pluginManagement
Source: CVE Program / CVE List V5
Vulnerability Description
In Gradle from version 5.1 and before version 7.0 there is a vulnerability which can lead to information disclosure and/or dependency poisoning. Repository content filtering is a security control Gradle introduced to help users specify what repositories are used to resolve specific dependencies. This feature was introduced in the wake of the "A Confusing Dependency" blog post. In some cases, Gradle may ignore content filters and search all repositories for dependencies. This only occurs when repository content filtering is used from within a `pluginManagement` block in a settings file. This may change how dependencies are resolved for Gradle plugins and build scripts. For builds that are vulnerable, there are two risks: 1) Information disclosure: Gradle could make dependency requests to repositories outside your organization and leak internal package identifiers. 2) Dependency poisoning/Dependency confusion: Gradle could download a malicious binary from a repository outside your organization due to name squatting. For a full example and more details refer to the referenced GitHub Security Advisory. The problem has been patched and released with Gradle 7.0. Users relying on this feature should upgrade their build as soon as possible. As a workaround, users may use a company repository which has the right rules for fetching packages from public repositories, or use project level repository content filtering, inside `buildscript.repositories`. This option is available since Gradle 5.1 when the feature was introduced.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
从非可信控制范围包含功能例程
Source: CVE Program / CVE List V5
Vulnerability Title
Gradle 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Gradle是美国Gradle公司的一套基于JVM的项目构建工具，它支持maven、Ivy仓库等。 Gradle 5.1版及7.0版之前存在安全漏洞，该漏洞可能导致信息泄露和/或依赖项中毒。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
gradle gradle >= 5.1, <= 6.8.3 -

II. Public POCs for CVE-2021-29427

# POC Description Source Link Shenlong Link
1 gradle cve https://github.com/arsalanraja987/gradle-cve-2021-29427-demo POC Details
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2021-29427

请登录查看更多情报信息。

Vendor Advisories for CVE-2021-29427 (1)

Other References for CVE-2021-29427 (1)

IV. Related Vulnerabilities

Same product: gradle
Same vendor: gradle
Same weakness: CWE-829

V. Comments for CVE-2021-29427

No comments yet

Leave a comment