CVE-2023-26053
No fix known EPSS <1%CVSS 6.6
Gradle is a build tool with a focus on build automation and support for multi-language development. This is a collision attack on long IDs (64bits) for PGP keys. Users of dependency verification in Gradle are vulnerable if they use long IDs for PGP keys in a `trusted-key` or `pgp` element in their dependency verification metadata file. The fix is to fail dependency verification if anything but a fingerprint is used in a trust element in dependency verification metadata. The problem is fixed in Gradle 8.0 and above. The problem is also patched in Gradle 6.9.4 and 7.6.1. As a workaround, use only full fingerprint IDs for `trusted-key` or `pgp` element in the metadata is a protection against this issue.
Products: gradle
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Chainguard | eco-java-gradle-6.2.1 | no fix |
| Chainguard | eco-java-gradle-6.2.1-default | no fix |
| Chainguard | eco-java-gradle-6.2.2 | no fix |
| Chainguard | eco-java-gradle-6.2.2-default | no fix |
| Chainguard | eco-java-gradle-6.3 | no fix |
| Chainguard | eco-java-gradle-6.3-default | no fix |
| Chainguard | eco-java-gradle-6.4 | no fix |
| Chainguard | eco-java-gradle-6.4-default | no fix |
| Chainguard | eco-java-gradle-6.4.1 | no fix |
| Chainguard | eco-java-gradle-6.4.1-default | no fix |
| Chainguard | eco-java-gradle-6.5 | no fix |
| Chainguard | eco-java-gradle-6.5-default | no fix |
| Chainguard | eco-java-gradle-6.5.1 | no fix |
| Chainguard | eco-java-gradle-6.5.1-default | no fix |
| Chainguard | eco-java-gradle-6.6 | no fix |
| Chainguard | eco-java-gradle-6.6-default | no fix |
| Chainguard | eco-java-gradle-6.6.1 | no fix |
| Chainguard | eco-java-gradle-6.6.1-default | no fix |
| Chainguard | eco-java-gradle-6.7 | no fix |
| Chainguard | eco-java-gradle-6.7-default | no fix |
| Chainguard | eco-java-gradle-6.7.1 | no fix |
| Chainguard | eco-java-gradle-6.7.1-default | no fix |
| Chainguard | eco-java-gradle-6.8 | no fix |
| Chainguard | eco-java-gradle-6.8-default | no fix |
| Chainguard | eco-java-gradle-6.8.1 | no fix |
| Chainguard | eco-java-gradle-6.8.1-default | no fix |
| Chainguard | eco-java-gradle-6.8.2 | no fix |
| Chainguard | eco-java-gradle-6.8.2-default | no fix |
| Chainguard | eco-java-gradle-6.8.3 | no fix |
| Chainguard | eco-java-gradle-6.8.3-default | no fix |
| Chainguard | eco-java-gradle-6.9 | no fix |
| Chainguard | eco-java-gradle-6.9-default | no fix |
| Chainguard | eco-java-gradle-6.9.1 | no fix |
| Chainguard | eco-java-gradle-6.9.1-default | no fix |
| Chainguard | eco-java-gradle-6.9.2 | no fix |
| Chainguard | eco-java-gradle-6.9.2-default | no fix |
| Chainguard | eco-java-gradle-6.9.3 | no fix |
| Chainguard | eco-java-gradle-6.9.3-default | no fix |
| Chainguard | eco-java-gradle-7.0.1 | no fix |
| Chainguard | eco-java-gradle-7.0.1-default | no fix |
| Chainguard | eco-java-gradle-7.0.2 | no fix |
| Chainguard | eco-java-gradle-7.0.2-default | no fix |
| Chainguard | eco-java-gradle-7.1 | no fix |
| Chainguard | eco-java-gradle-7.1-default | no fix |
| Chainguard | eco-java-gradle-7.1.1 | no fix |
| Chainguard | eco-java-gradle-7.1.1-default | no fix |
| Chainguard | eco-java-gradle-7.2 | no fix |
| Chainguard | eco-java-gradle-7.2-default | no fix |
| Chainguard | eco-java-gradle-7.3 | no fix |
| Chainguard | eco-java-gradle-7.3-default | no fix |
| Chainguard | eco-java-gradle-7.3.1 | no fix |
| Chainguard | eco-java-gradle-7.3.1-default | no fix |
| Chainguard | eco-java-gradle-7.3.2 | no fix |
| Chainguard | eco-java-gradle-7.3.2-default | no fix |
| Chainguard | eco-java-gradle-7.3.3 | no fix |
| Chainguard | eco-java-gradle-7.3.3-default | no fix |
| Chainguard | eco-java-gradle-7.4 | no fix |
| Chainguard | eco-java-gradle-7.4-default | no fix |
| Chainguard | eco-java-gradle-7.4.1 | no fix |
| Chainguard | eco-java-gradle-7.4.1-default | no fix |
| Chainguard | eco-java-gradle-7.4.2 | no fix |
| Chainguard | eco-java-gradle-7.4.2-default | no fix |
| Chainguard | eco-java-gradle-7.5 | no fix |
| Chainguard | eco-java-gradle-7.5-default | no fix |
| Chainguard | eco-java-gradle-7.5.1 | no fix |
| Chainguard | eco-java-gradle-7.5.1-default | no fix |
| Chainguard | eco-java-gradle-7.6 | no fix |
| Chainguard | eco-java-gradle-7.6-default | no fix |
| Ubuntu 16.04 LTS | gradle | no fix |
| Ubuntu 20.04 LTS | gradle | no fix |
| Ubuntu 22.04 LTS | gradle | no fix |
| Ubuntu 24.04 LTS | gradle | no fix |
| Ubuntu 25.10 | gradle | no fix |
| Ubuntu 26.04 LTS | gradle | no fix |
| Ubuntu 26.10 | gradle | no fix |
| Ubuntu Pro 18.04 LTS | gradle | no fix |