swagger-api / swagger-api/swagger-codegen

Vulnerable gradle wrapper used

Open
#10,404 6 comments 5 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
Mustache
Stars
17.8k
Forks
6k
PR merge metrics
No merged PRs in 30d

Description

Description

Vulnerable gradle wrapper referenced in swagger-codegen
wagger-codegen-2.3.1.jar\android\gradle-wrapper.jar

It has following vulnerabilities associated with it:

  1. ObjectSocketWrapper.java in Gradle 2.12 allows remote attackers to execute arbitrary code via a crafted serialized object.

https://nvd.nist.gov/vuln/detail/CVE-2016-6199
CVSS Base score : 9.8 Critical

  1. The HTTP client in Gradle before 5.6 sends authentication credentials originally destined for the configured host. If that host returns a 30x redirect, Gradle also sends those credentials to all subsequent hosts that the request redirects to. This is similar to CVE-2018-1000007.

https://nvd.nist.gov/vuln/detail/CVE-2019-15052
CVSS Base score : 9.8 Critical

Swagger-codegen version

2.3.1

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by locating swagger-codegen-2.3.1.jar/android/gradle-wrapper.jar and the Android Gradle wrapper configuration in the repository. Check which Gradle version is used and determine a supported version without the cited vulnerabilities. Done means the vulnerable wrapper is no longer referenced or packaged.

Written by the indexing model from the issue text.

Assessment

Domain
build-system, security
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
30/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.