CVE-2023-42445
No fix known EPSS <1%CVSS 6.8
Gradle is a build tool with a focus on build automation and support for multi-language development. In some cases, when Gradle parses XML files, resolving XML external entities is not disabled. Combined with an Out Of Band XXE attack (OOB-XXE), just parsing XML can lead to exfiltration of local text files to a remote server. Gradle parses XML files for several purposes. Most of the time, Gradle parses XML files it generated or were already present locally. Only Ivy XML descriptors and Maven POM files can be fetched from remote repositories and parsed by Gradle. In Gradle 7.6.3 and 8.4, resolving XML external entities has been disabled for all use cases to protect against this vulnerability. Gradle will now refuse to parse XML files that have XML external entities.
Products: gradle
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Chainguard | eco-java-gradle | no fix |
| Chainguard | eco-java-gradle-1.11 | no fix |
| Chainguard | eco-java-gradle-1.11-default | no fix |
| Chainguard | eco-java-gradle-2.0 | no fix |
| Chainguard | eco-java-gradle-2.0-default | no fix |
| Chainguard | eco-java-gradle-2.1 | no fix |
| Chainguard | eco-java-gradle-2.1-default | no fix |
| Chainguard | eco-java-gradle-2.10 | no fix |
| Chainguard | eco-java-gradle-2.10-default | no fix |
| Chainguard | eco-java-gradle-2.11 | no fix |
| Chainguard | eco-java-gradle-2.11-default | no fix |
| Chainguard | eco-java-gradle-2.12 | no fix |
| Chainguard | eco-java-gradle-2.12-default | no fix |
| Chainguard | eco-java-gradle-2.13 | no fix |
| Chainguard | eco-java-gradle-2.13-default | no fix |
| Chainguard | eco-java-gradle-2.14 | no fix |
| Chainguard | eco-java-gradle-2.14-default | no fix |
| Chainguard | eco-java-gradle-2.14.1 | no fix |
| Chainguard | eco-java-gradle-2.14.1-default | no fix |
| Chainguard | eco-java-gradle-2.2 | no fix |
| Chainguard | eco-java-gradle-2.2-default | no fix |
| Chainguard | eco-java-gradle-2.2.1 | no fix |
| Chainguard | eco-java-gradle-2.2.1-default | no fix |
| Chainguard | eco-java-gradle-2.3 | no fix |
| Chainguard | eco-java-gradle-2.3-default | no fix |
| Chainguard | eco-java-gradle-2.4 | no fix |
| Chainguard | eco-java-gradle-2.4-default | no fix |
| Chainguard | eco-java-gradle-2.5 | no fix |
| Chainguard | eco-java-gradle-2.5-default | no fix |
| Chainguard | eco-java-gradle-2.6 | no fix |
| Chainguard | eco-java-gradle-2.6-default | no fix |
| Chainguard | eco-java-gradle-2.7 | no fix |
| Chainguard | eco-java-gradle-2.7-default | no fix |
| Chainguard | eco-java-gradle-2.8 | no fix |
| Chainguard | eco-java-gradle-2.8-default | no fix |
| Chainguard | eco-java-gradle-2.9 | no fix |
| Chainguard | eco-java-gradle-2.9-default | no fix |
| Chainguard | eco-java-gradle-3.0 | no fix |
| Chainguard | eco-java-gradle-3.0-default | no fix |
| Chainguard | eco-java-gradle-3.1 | no fix |
| Chainguard | eco-java-gradle-3.1-default | no fix |
| Chainguard | eco-java-gradle-3.2 | no fix |
| Chainguard | eco-java-gradle-3.2-default | no fix |
| Chainguard | eco-java-gradle-3.2.1 | no fix |
| Chainguard | eco-java-gradle-3.2.1-default | no fix |
| Chainguard | eco-java-gradle-3.3 | no fix |
| Chainguard | eco-java-gradle-3.3-default | no fix |
| Chainguard | eco-java-gradle-3.4 | no fix |
| Chainguard | eco-java-gradle-3.4-default | no fix |
| Chainguard | eco-java-gradle-3.4.1 | no fix |
| Chainguard | eco-java-gradle-3.4.1-default | no fix |
| Chainguard | eco-java-gradle-3.5 | no fix |
| Chainguard | eco-java-gradle-3.5-default | no fix |
| Chainguard | eco-java-gradle-3.5.1 | no fix |
| Chainguard | eco-java-gradle-3.5.1-default | no fix |
| Chainguard | eco-java-gradle-4.0 | no fix |
| Chainguard | eco-java-gradle-4.0-default | no fix |
| Chainguard | eco-java-gradle-4.0.1 | no fix |
| Chainguard | eco-java-gradle-4.0.1-default | no fix |
| Chainguard | eco-java-gradle-4.0.2 | no fix |
| Chainguard | eco-java-gradle-4.0.2-default | no fix |
| Chainguard | eco-java-gradle-4.1 | no fix |
| Chainguard | eco-java-gradle-4.1-default | no fix |
| Chainguard | eco-java-gradle-4.10 | no fix |
| Chainguard | eco-java-gradle-4.10-default | no fix |
| Chainguard | eco-java-gradle-4.10.1 | no fix |
| Chainguard | eco-java-gradle-4.10.1-default | no fix |
| Chainguard | eco-java-gradle-4.10.2 | no fix |
| Chainguard | eco-java-gradle-4.10.2-default | no fix |
| Chainguard | eco-java-gradle-4.10.3 | no fix |
| Chainguard | eco-java-gradle-4.10.3-default | no fix |
| Chainguard | eco-java-gradle-4.2 | no fix |
| Chainguard | eco-java-gradle-4.2-default | no fix |
| Chainguard | eco-java-gradle-4.2.1 | no fix |
| Chainguard | eco-java-gradle-4.2.1-default | no fix |
| Chainguard | eco-java-gradle-4.3 | no fix |
| Chainguard | eco-java-gradle-4.3-default | no fix |
| Chainguard | eco-java-gradle-4.3.1 | no fix |
| Chainguard | eco-java-gradle-4.3.1-default | no fix |
| Chainguard | eco-java-gradle-4.4 | no fix |
| Chainguard | eco-java-gradle-4.4-default | no fix |
| Chainguard | eco-java-gradle-4.4.1 | no fix |
| Chainguard | eco-java-gradle-4.4.1-default | no fix |
| Chainguard | eco-java-gradle-4.5 | no fix |
| Chainguard | eco-java-gradle-4.5-default | no fix |
| Chainguard | eco-java-gradle-4.5.1 | no fix |
| Chainguard | eco-java-gradle-4.5.1-default | no fix |
| Chainguard | eco-java-gradle-4.6 | no fix |
| Chainguard | eco-java-gradle-4.6-default | no fix |
| Chainguard | eco-java-gradle-4.7 | no fix |
| Chainguard | eco-java-gradle-4.7-default | no fix |
| Chainguard | eco-java-gradle-4.8 | no fix |
| Chainguard | eco-java-gradle-4.8-default | no fix |
| Chainguard | eco-java-gradle-4.8.1 | no fix |
| Chainguard | eco-java-gradle-4.8.1-default | no fix |
| Chainguard | eco-java-gradle-4.9 | no fix |
| Chainguard | eco-java-gradle-4.9-default | no fix |
| Chainguard | eco-java-gradle-5.0 | no fix |
| Chainguard | eco-java-gradle-5.0-default | no fix |
| Chainguard | eco-java-gradle-5.1 | no fix |
| Chainguard | eco-java-gradle-5.1-default | no fix |
| Chainguard | eco-java-gradle-5.1.1 | no fix |
| Chainguard | eco-java-gradle-5.1.1-default | no fix |
| Chainguard | eco-java-gradle-5.2 | no fix |
| Chainguard | eco-java-gradle-5.2-default | no fix |
| Chainguard | eco-java-gradle-5.2.1 | no fix |
| Chainguard | eco-java-gradle-5.2.1-default | no fix |
| Chainguard | eco-java-gradle-5.3 | no fix |
| Chainguard | eco-java-gradle-5.3-default | no fix |
| Chainguard | eco-java-gradle-5.3.1 | no fix |
| Chainguard | eco-java-gradle-5.3.1-default | no fix |
| Chainguard | eco-java-gradle-5.4 | no fix |
| Chainguard | eco-java-gradle-5.4-default | no fix |
| Chainguard | eco-java-gradle-5.4.1 | no fix |
| Chainguard | eco-java-gradle-5.4.1-default | no fix |
| Chainguard | eco-java-gradle-5.5 | no fix |
| Chainguard | eco-java-gradle-5.5-default | no fix |
| Chainguard | eco-java-gradle-5.5.1 | no fix |
| Chainguard | eco-java-gradle-5.5.1-default | no fix |
| Chainguard | eco-java-gradle-5.6 | no fix |
| Chainguard | eco-java-gradle-5.6-default | no fix |
| Chainguard | eco-java-gradle-5.6.1 | no fix |
| Chainguard | eco-java-gradle-5.6.1-default | no fix |
| Chainguard | eco-java-gradle-5.6.2 | no fix |
| Chainguard | eco-java-gradle-5.6.2-default | no fix |
| Chainguard | eco-java-gradle-5.6.3 | no fix |
| Chainguard | eco-java-gradle-5.6.3-default | no fix |
| Chainguard | eco-java-gradle-5.6.4 | no fix |
| Chainguard | eco-java-gradle-5.6.4-default | no fix |
| Chainguard | eco-java-gradle-6.0 | no fix |
| Chainguard | eco-java-gradle-6.0-default | no fix |
| Chainguard | eco-java-gradle-6.0.1 | no fix |
| Chainguard | eco-java-gradle-6.0.1-default | no fix |
| Chainguard | eco-java-gradle-6.1 | no fix |
| Chainguard | eco-java-gradle-6.1-default | no fix |
| Chainguard | eco-java-gradle-6.1.1 | no fix |
| Chainguard | eco-java-gradle-6.1.1-default | no fix |
| Chainguard | eco-java-gradle-6.2 | no fix |
| Chainguard | eco-java-gradle-6.2-default | no fix |
| Chainguard | eco-java-gradle-6.2.1 | no fix |
| Chainguard | eco-java-gradle-6.2.1-default | no fix |
| Chainguard | eco-java-gradle-6.2.2 | no fix |
| Chainguard | eco-java-gradle-6.2.2-default | no fix |
| Chainguard | eco-java-gradle-6.3 | no fix |
| Chainguard | eco-java-gradle-6.3-default | no fix |
| Chainguard | eco-java-gradle-6.4 | no fix |
| Chainguard | eco-java-gradle-6.4-default | no fix |
| Chainguard | eco-java-gradle-6.4.1 | no fix |
| Chainguard | eco-java-gradle-6.4.1-default | no fix |
| Chainguard | eco-java-gradle-6.5 | no fix |
| Chainguard | eco-java-gradle-6.5-default | no fix |
| Chainguard | eco-java-gradle-6.5.1 | no fix |
| Chainguard | eco-java-gradle-6.5.1-default | no fix |
| Chainguard | eco-java-gradle-6.6 | no fix |
| Chainguard | eco-java-gradle-6.6-default | no fix |
| Chainguard | eco-java-gradle-6.6.1 | no fix |
| Chainguard | eco-java-gradle-6.6.1-default | no fix |
| Chainguard | eco-java-gradle-6.7 | no fix |
| Chainguard | eco-java-gradle-6.7-default | no fix |
| Chainguard | eco-java-gradle-6.7.1 | no fix |
| Chainguard | eco-java-gradle-6.7.1-default | no fix |
| Chainguard | eco-java-gradle-6.8 | no fix |
| Chainguard | eco-java-gradle-6.8-default | no fix |
| Chainguard | eco-java-gradle-6.8.1 | no fix |
| Chainguard | eco-java-gradle-6.8.1-default | no fix |
| Chainguard | eco-java-gradle-6.8.2 | no fix |
| Chainguard | eco-java-gradle-6.8.2-default | no fix |
| Chainguard | eco-java-gradle-6.8.3 | no fix |
| Chainguard | eco-java-gradle-6.8.3-default | no fix |
| Chainguard | eco-java-gradle-6.9 | no fix |
| Chainguard | eco-java-gradle-6.9-default | no fix |
| Chainguard | eco-java-gradle-6.9.1 | no fix |
| Chainguard | eco-java-gradle-6.9.1-default | no fix |
| Chainguard | eco-java-gradle-6.9.2 | no fix |
| Chainguard | eco-java-gradle-6.9.2-default | no fix |
| Chainguard | eco-java-gradle-6.9.3 | no fix |
| Chainguard | eco-java-gradle-6.9.3-default | no fix |
| Chainguard | eco-java-gradle-6.9.4 | no fix |
| Chainguard | eco-java-gradle-6.9.4-default | no fix |
| Chainguard | eco-java-gradle-7.0 | no fix |
| Chainguard | eco-java-gradle-7.0-default | no fix |
| Chainguard | eco-java-gradle-7.0.1 | no fix |
| Chainguard | eco-java-gradle-7.0.1-default | no fix |
| Chainguard | eco-java-gradle-7.0.2 | no fix |
| Chainguard | eco-java-gradle-7.0.2-default | no fix |
| Chainguard | eco-java-gradle-7.1 | no fix |
| Chainguard | eco-java-gradle-7.1-default | no fix |
| Chainguard | eco-java-gradle-7.1.1 | no fix |
| Chainguard | eco-java-gradle-7.1.1-default | no fix |
| Chainguard | eco-java-gradle-7.2 | no fix |
| Chainguard | eco-java-gradle-7.2-default | no fix |
| Chainguard | eco-java-gradle-7.3 | no fix |
| Chainguard | eco-java-gradle-7.3-default | no fix |
| Chainguard | eco-java-gradle-7.3.1 | no fix |
| Chainguard | eco-java-gradle-7.3.1-default | no fix |
| Chainguard | eco-java-gradle-7.3.2 | no fix |
| Chainguard | eco-java-gradle-7.3.2-default | no fix |
| Chainguard | eco-java-gradle-7.3.3 | no fix |
| Chainguard | eco-java-gradle-7.3.3-default | no fix |
| Chainguard | eco-java-gradle-7.4 | no fix |
| Chainguard | eco-java-gradle-7.4-default | no fix |
| Chainguard | eco-java-gradle-7.4.1 | no fix |
| Chainguard | eco-java-gradle-7.4.1-default | no fix |
| Chainguard | eco-java-gradle-7.4.2 | no fix |
| Chainguard | eco-java-gradle-7.4.2-default | no fix |
| Chainguard | eco-java-gradle-7.5 | no fix |
| Chainguard | eco-java-gradle-7.5-default | no fix |
| Chainguard | eco-java-gradle-7.5.1 | no fix |
| Chainguard | eco-java-gradle-7.5.1-default | no fix |
| Chainguard | eco-java-gradle-7.6 | no fix |
| Chainguard | eco-java-gradle-7.6-default | no fix |
| Chainguard | eco-java-gradle-7.6.1 | no fix |
| Chainguard | eco-java-gradle-7.6.1-default | no fix |
| Chainguard | eco-java-gradle-7.6.2 | no fix |
| Chainguard | eco-java-gradle-7.6.2-default | no fix |
| Chainguard | eco-java-gradle-8.0.1 | no fix |
| Chainguard | eco-java-gradle-8.0.1-default | no fix |
| Chainguard | eco-java-gradle-8.0.2 | no fix |
| Chainguard | eco-java-gradle-8.0.2-default | no fix |
| Chainguard | eco-java-gradle-8.1 | no fix |
| Chainguard | eco-java-gradle-8.1-default | no fix |
| Chainguard | eco-java-gradle-8.1.1 | no fix |
| Chainguard | eco-java-gradle-8.1.1-default | no fix |
| Chainguard | eco-java-gradle-8.2 | no fix |
| Chainguard | eco-java-gradle-8.2-default | no fix |
| Chainguard | eco-java-gradle-8.2.1 | no fix |
| Chainguard | eco-java-gradle-8.2.1-default | no fix |
| Chainguard | eco-java-gradle-8.3 | no fix |
| Chainguard | eco-java-gradle-8.3-default | no fix |
| Chainguard | eco-java-gradle-8.4 | no fix |
| Chainguard | eco-java-gradle-8.4-default | no fix |
| Debian:12 | gradle | no fix |
| Debian:13 | gradle | no fix |
| Debian:14 | gradle | no fix |
| Ubuntu:16.04:LTS | gradle | no fix |
| Ubuntu:20.04:LTS | gradle | no fix |
| Ubuntu:22.04:LTS | gradle | no fix |
| Ubuntu:24.04:LTS | gradle | no fix |
| Ubuntu:25.10 | gradle | no fix |
| Ubuntu:26.04:LTS | gradle | no fix |
| Ubuntu:26.10 | gradle | no fix |
| Ubuntu:Pro:18.04:LTS | gradle | no fix |