VYPR
← All advisories
Medium severity5.9OSV Advisory· Published Apr 10, 2019· Updated Jun 17, 2026

CVE-2019-11065

CVE-2019-11065

Description

Gradle versions from 1.4 to 5.3.1 use an insecure HTTP URL to download dependencies when the built-in JavaScript or CoffeeScript Gradle plugins are used. Dependency artifacts could have been maliciously compromised by a MITM attack against the ajax.googleapis.com web site.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
org.gradle:gradle-coreMaven
>= 1.4, < 5.4.05.4.0

Affected products

6
  • Gradle/GradleOSV2 versions
    (expand)+ 1 more
    • (no CPE)
    • cpe:2.3:a:gradle:gradle:*:*:*:*:*:*:*:*range: >=1.4,<=5.3.1
  • Fedoraproject/Fedora3 versions
    cpe:2.3:o:fedoraproject:fedora:28:*:*:*:*:*:*:*+ 2 more
    • cpe:2.3:o:fedoraproject:fedora:28:*:*:*:*:*:*:*
    • cpe:2.3:o:fedoraproject:fedora:29:*:*:*:*:*:*:*
    • cpe:2.3:o:fedoraproject:fedora:30:*:*:*:*:*:*:*
  • ghsa-coords
    pkg:maven/org.gradle/gradle-core
    Range: >= 1.4, < 5.4.0

Patches

Vulnerability mechanics

References

9

News mentions

0

No linked articles in our index yet.