GHSA-hhr2-f668-ff2w
Suggest an improvement- Source
- https://github.com/advisories/GHSA-hhr2-f668-ff2w
- Import Source
- https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-hhr2-f668-ff2w/GHSA-hhr2-f668-ff2w.json
- JSON Data
- https://api.osv.dev/v1/vulns/GHSA-hhr2-f668-ff2w
- Aliases
- Published
- 2022-05-24T16:56:18Z
- Modified
- 2023-11-08T04:01:17.678434Z
- Summary
- Use of a weak cryptographic algorithm in Gradle
- Details
-
The PGP signing plugin in Gradle before 6.0 relies on the SHA-1 algorithm, which might allow an attacker to replace an artifact with a different one that has the same SHA-1 message digest, a related issue to CVE-2005-4900.
- Database specific
{ "nvd_published_at": "2019-09-16T18:15:00Z", "cwe_ids": [ "CWE-327" ], "severity": "LOW", "github_reviewed": true, "github_reviewed_at": "2022-11-01T23:37:01Z" }- References
Affected packages
Maven / org.gradle:gradle-core
Package
- Name
- org.gradle:gradle-core
- View open source insights on deps.dev
- Purl
- pkg:maven/org.gradle/gradle-core