Insertion of Sensitive Information into Log File Affecting com.gradle.plugin-publish:com.gradle.plugin-publish.gradle.plugin package, versions [,0.11.0)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.Test your applications
28 Mar 2020
27 Mar 2020
Danny Thomas of Netflix
How to fix?
com.gradle.plugin-publish:com.gradle.plugin-publish.gradle.plugin to version 0.11.0 or higher.
com.gradle.plugin-publish:com.gradle.plugin-publish.gradle.plugin is a plugin that publishes plugins to the Gradle Plugin Portal.
Affected versions of this package are vulnerable to Insertion of Sensitive Information into Log File. When a plugin author publishes a Gradle plugin while running Gradle with the
--info log level flag, the Gradle Logger logs an AWS pre-signed URL. If this build log is publicly visible (as it is in many popular public CI systems like TravisCI) this AWS pre-signed URL would allow a malicious actor to replace a recently uploaded plugin with their own. Malicious plugins can be potentially used to perform large scale supply chain attacks.
An example of this sensitive data leakage can be found here: https://travis-ci.org/nebula-plugins/nebula-kotlin-plugin/jobs/657945740#L660-L668