Lightrun Answers was designed to reduce the constant googling that comes with debugging 3rd party libraries. It collects links to all the places you might be looking at while hunting down a tough bug.
And, if you’re still stuck at the end, we’re happy to hop on a call to see how we can help out.
[SECURITY] CVE-2019-10753: Releases are built/executed/released in the context of insecure/untrusted code
See original GitHub issueCWE-829: Inclusion of Functionality from Untrusted Control Sphere
The build files indicate that this project is resolving dependencies over HTTP instead of HTTPS. Any of these artifacts could have been MITM to maliciously compromise them and infect the build artifacts that were produced. Additionally, if any of these JAR files were compromised, any developers using these could continue to be infected past updating to fix this.
- https://github.com/diffplug/spotless/blob/366c1b9042ec938cf70ee19a152570f91426c6fb/_ext/eclipse-cdt/build.gradle#L6
- https://github.com/diffplug/spotless/blob/96e74ec3fb5ca050ec5aa67f4801e11bf744acef/_ext/eclipse-groovy/build.gradle#L6
- https://github.com/diffplug/spotless/blob/e1734c082a1123d8a40df9424fb021873d7744ad/_ext/eclipse-wtp/build.gradle#L6
This vulnerability has a CVSS v3.0 Base Score of 8.1/10 https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?vector=AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
This isn’t just theoretical; POC code exists already to maliciously compromise jar file inflight.
See:
- https://max.computer/blog/how-to-take-over-the-computer-of-any-java-or-clojure-or-scala-developer/
- https://github.com/mveytsman/dilettante
To fix: We need to update our build.gradle so that artifacts are resolved over HTTPS instead of HTTP.
I’ve been finding this vulnerability in a lot of places today and have responsibly disclosed it to some of the larger organizations involved.
Issue Analytics
- State:
- Created 5 years ago
- Reactions:1
- Comments:36 (34 by maintainers)
Top Results From Across the Web
Top Related Medium Post
Top Related StackOverflow Question
Troubleshoot Live Code
Top Related Reddit Thread
Top Related Hackernoon Post
Top Related Tweet
Top Related Dev.to Post
Top Related Hashnode Post
@JLLeitschuh @nedtwigg Hi I’m Leeya, Security Analyst at Snyk. We issued a CVE number - CVE-2019-10753. It will be public soon but meanwhile, we added the issue to our db: SNYK-JAVA-COMDIFFPLUGGRADLESPOTLESS-174875 SNYK-JAVA-COMDIFFPLUGGRADLESPOTLESS-174876 SNYK-JAVA-COMDIFFPLUGSPOTLESS-460377 I believe you can close the issue now 🙂
Okay, the fixed jars have all been published, and we can be sure that future jars will be downloaded over https. Next up is to compare these new jars to the old jars. If they have the exact same content, then we got away with it 😉. Otherwise, we should try to figure out why they’re different, and disclose our findings.