A security issue has been found in Gradle versions 5.1 up to 6.8.3. Repository content filtering is a security control Gradle introduced to help users specify what repositories are used to resolve specific dependencies. This feature was introduced in the wake of the "A Confusing Dependency" blog post. In some cases, Gradle may ignore content filters and search all repositories for dependencies. This only occurs when repository content filtering is used from within a pluginManagement block in a settings file. This may change how dependencies are resolved for Gradle plugins and build scripts. For builds that are vulnerable, there are two risks: - Information disclosure: Gradle could make dependency requests to repositories outside your organization and leak internal package identifiers. - Dependency poisoning/Dependency confusion: Gradle could download a malicious binary from a repository outside your organization due to name squatting. The problem has been patched and released with Gradle 7.0.
A security issue has been found in Gradle versions 5.1 up to 6.8.3. Repository content filtering is a security control Gradle introduced to help users specify what repositories are used to resolve specific dependencies. This feature was introduced in the wake of the "A Confusing Dependency" blog post. In some cases, Gradle may ignore content filters and search all repositories for dependencies. This only occurs when repository content filtering is used from within a pluginManagement block in a settings file. This may change how dependencies are resolved for Gradle plugins and build scripts. For builds that are vulnerable, there are two risks: - Information disclosure: Gradle could make dependency requests to repositories outside your organization and leak internal package identifiers. - Dependency poisoning/Dependency confusion: Gradle could download a malicious binary from a repository outside your organization due to name squatting. The problem has been patched and released with Gradle 7.0.
https://github.com/gradle/gradle/security/advisories/GHSA-jvmj-rh6q-x395 https://blog.autsoft.hu/a-confusing-dependency/
Vulmon