{"id":"CVE-2019-16370","aliases":["DEBIAN-CVE-2019-16370","EUVD-2022-4164","GHSA-hhr2-f668-ff2w","OESA-2021-1309","UBUNTU-CVE-2019-16370","USN-4858-1","openSUSE-SU-2024:10817-1"],"status":"published","title":"Use of a weak cryptographic algorithm in Gradle","description":"The PGP signing plugin in Gradle before 6.0 relies on the SHA-1 algorithm, which might allow an attacker to replace an artifact with a different one that has the same SHA-1 message digest, a related issue to CVE-2005-4900.","severity":{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-10","score":0.00891,"percentile":0.59719,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-327"],"published":"2019-09-16T17:50:28Z","modified":"2026-10-20T10:52:26Z","fixes":[{"ecosystem":"Maven","package":"org.gradle:gradle-core","fixed_in":["6.0"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:12","package":"gradle","fixed_in":["4.4.1-18"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"gradle","fixed_in":["4.4.1-18"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"gradle","fixed_in":["4.4.1-18"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP1","package":"gradle","fixed_in":["4.4.1-2.oe1"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP2","package":"gradle","fixed_in":["4.4.1-2.oe1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"gradle","fixed_in":["4.4.1-5ubuntu2~18.04+esm1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"gradle","fixed_in":["4.4.1-7.2"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.gradle:gradle-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"gradle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.1-18"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"gradle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.1-18"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"gradle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.1-18"}]}]},{"source":"osv","ecosystem":"Maven","package":"org.gradle:gradle-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP1","package":"gradle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.1-2.oe1"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP2","package":"gradle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.1-2.oe1"}]}]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"gradle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.5-3","2.7-1","2.7-2","2.7-3","2.10-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"gradle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.1-5ubuntu2~18.04+esm1"}]}],"versions":["3.2.1-3build2","3.2.1-4","3.2.1-5","3.4.1-4","3.4.1-6","3.4.1-7ubuntu1","4.4.1-5ubuntu2~18.04"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"gradle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.4.1-8","4.4.1-9","4.4.1-10"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"gradle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.4.1-13"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"gradle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.4.1-18","4.4.1-20"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"gradle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.4.1-22"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"gradle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.4.1-22ubuntu1","4.4.1-23"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"gradle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.4.1-22","4.4.1-22build1","4.4.1-22ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"gradle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.1-5ubuntu2~18.04+esm1"}]}],"versions":["3.2.1-3build2","3.2.1-4","3.2.1-5","3.4.1-4","3.4.1-6","3.4.1-7ubuntu1","4.4.1-5ubuntu2~18.04"],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"gradle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.1-7.2"}]}]}],"products":[{"vendor":"gradle","product":"gradle"}],"references":[{"url":"https://github.com/gradle/gradle/pull/10543","tags":["x_refsource_MISC","x_transferred","Exploit","Patch","Third Party Advisory","fix","web","report"]},{"url":"https://github.com/gradle/gradle/commit/425b2b7a50cd84106a77cdf1ab665c89c6b14d2f","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","web","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-16370","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-hhr2-f668-ff2w"},{"url":"https://security-tracker.debian.org/tracker/CVE-2019-16370","tags":["advisory"]},{"url":"https://openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2021-1309","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2019-16370","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-4858-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-16370","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-11065","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2019-16370","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2019-16370","description":"The PGP signing plugin in Gradle before 6.0 relies on the SHA-1 algorithm, which might allow an attacker to replace an artifact with a different one that has the same SHA-1 message digest, a related issue to CVE-2005-4900.","status":"published","published":"2019-09-16T17:50:28Z","modified":"2024-08-05T01:10:41.829Z","updated_at":"2026-11-02T14:32:23.485011Z"}],"euvd":[{"id":"EUVD-2022-4164","description":"The PGP signing plugin in Gradle before 6.0 relies on the SHA-1 algorithm, which might allow an attacker to replace an artifact with a different one that has the same SHA-1 message digest, a related issue to CVE-2005-4900.","status":"published","published":"2019-09-16T17:50:28Z","modified":"2024-08-05T01:10:41Z","updated_at":"2026-11-03T02:40:33.179924Z"}],"ghsa":[{"id":"GHSA-hhr2-f668-ff2w","title":"Use of a weak cryptographic algorithm in Gradle","description":"The PGP signing plugin in Gradle before 6.0 relies on the SHA-1 algorithm, which might allow an attacker to replace an artifact with a different one that has the same SHA-1 message digest, a related issue to CVE-2005-4900.","status":"published","published":"2022-05-24T16:56:18Z","modified":"2023-01-30T05:00:49Z","cwes":["CWE-327"],"updated_at":"2026-11-02T14:36:26.667347Z"}],"nvd":[{"id":"CVE-2019-16370","description":"The PGP signing plugin in Gradle before 6.0 relies on the SHA-1 algorithm, which might allow an attacker to replace an artifact with a different one that has the same SHA-1 message digest, a related issue to CVE-2005-4900.","status":"published","published":"2019-09-16T18:15:12.19Z","modified":"2026-06-17T02:22:11.277Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-327"],"updated_at":"2026-11-02T14:05:28.126831Z"}],"osv":[{"id":"CVE-2019-16370","description":"The PGP signing plugin in Gradle before 6.0 relies on the SHA-1 algorithm, which might allow an attacker to replace an artifact with a different one that has the same SHA-1 message digest, a related issue to CVE-2005-4900.","status":"published","published":"2019-09-16T18:15:12.19Z","modified":"2026-10-20T10:52:26.09710045Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:11.361782Z"},{"id":"DEBIAN-CVE-2019-16370","description":"The PGP signing plugin in Gradle before 6.0 relies on the SHA-1 algorithm, which might allow an attacker to replace an artifact with a different one that has the same SHA-1 message digest, a related issue to CVE-2005-4900.","status":"published","published":"2019-09-16T18:15:12.19Z","modified":"2026-09-21T07:02:48.469887086Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:31.867036Z"},{"id":"OESA-2021-1309","title":"gradle security update","description":"Gradle is build automation evolved. Gradle can automate the building, testing, publishing, deployment and more of software packages or other types of projects such as generated static websites, generated documentation or indeed anything else. Gradle combines the power and flexibility of Ant with the dependency management and conventions of Maven into a more effective way to build. Powered by a Groovy DSL and packed with innovation, Gradle provides a declarative way to describe all kinds of builds through sensible defaults. Gradle is quickly becoming the build system of choice for many open source projects, leading edge enterprises and legacy automation challenges.\r\n\r\nSecurity Fix(es):\r\n\r\nThe PGP signing plugin in Gradle before 6.0 relies on the SHA-1 algorithm, which might allow an attacker to replace an artifact with a different one that has the same SHA-1 message digest, a related issue to CVE-2005-4900.(CVE-2019-16370)","status":"published","published":"2021-08-14T11:04:32Z","modified":"2026-08-18T01:15:51.189816489Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:52:38.987987Z"},{"id":"UBUNTU-CVE-2019-16370","description":"The PGP signing plugin in Gradle before 6.0 relies on the SHA-1 algorithm, which might allow an attacker to replace an artifact with a different one that has the same SHA-1 message digest, a related issue to CVE-2005-4900.","status":"published","published":"2019-09-16T18:15:00Z","modified":"2026-10-17T12:55:41.724156374Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:54:20.325378Z"},{"id":"GHSA-hhr2-f668-ff2w","title":"Use of a weak cryptographic algorithm in Gradle","description":"The PGP signing plugin in Gradle before 6.0 relies on the SHA-1 algorithm, which might allow an attacker to replace an artifact with a different one that has the same SHA-1 message digest, a related issue to CVE-2005-4900.","status":"published","published":"2022-05-24T16:56:18Z","modified":"2023-11-08T04:01:17.678434Z","cwes":["CWE-327"],"updated_at":"2026-11-02T15:46:49.28217Z"},{"id":"openSUSE-SU-2024:10817-1","title":"gradle-4.4.1-7.2 on GA media","description":"These are all security issues fixed in the gradle-4.4.1-7.2 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:18:54.432703Z","updated_at":"2026-11-02T16:58:34.487567Z"},{"id":"USN-4858-1","title":"gradle vulnerabilities","description":"It was discovered that Gradle used an insecure HTTP URL to download\ndependencies when the built-in JavaScript or CoffeeScript Gradle plugins\nwere used. A remote unauthenticated attacker could possibly use this issue\nto perform a machine-in-the-middle attack. (CVE-2019-11065)\n\nIt was discovered that the PGP signing plugin in Gradle relied on the\ninsecure SHA-1 algorithm. An attacker could possibly use this issue to\nconduct spoofing attacks. (CVE-2019-16370)\n","status":"published","published":"2021-03-15T22:44:10Z","modified":"2026-04-27T15:49:29.840458Z","updated_at":"2026-11-02T16:58:15.159055Z"}]}}