Debian Package Tracker

general

source: gradle (main)
version: 4.4.1-8
maintainer: Debian Java Maintainers (archive) (DMD)
uploaders: Kai-Chung Yan [DMD]
arch: all
std-ver: 4.3.0
VCS: Git (Browse, QA)

versions [more versions can be listed by madison] [old versions available from snapshot.debian.org]

[pool directory]

o-o-stable: 1.5-2
oldstable: 3.2.1-1
stable: 4.4.1-6
testing: 4.4.1-8
unstable: 4.4.1-8

versioned links

1.5-2: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
3.2.1-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
4.4.1-6: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
4.4.1-8: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]

binaries

gradle (5 bugs: 0, 3, 2, 0)
gradle-doc
libgradle-core-java (1 bugs: 0, 1, 0, 0)
libgradle-plugins-java

action needed

A new upstream version is available: 6.0.1 high

A new upstream version 6.0.1 is available, you should consider packaging it.

Created: 2018-09-29 Last update: 2019-12-05 20:48

3 security issues in buster high

There are 3 open security issues in buster.

2 important issues:

CVE-2019-15052: The HTTP client in Gradle before 5.6 sends authentication credentials originally destined for the configured host. If that host returns a 30x redirect, Gradle also sends those credentials to all subsequent hosts that the request redirects to. This is similar to CVE-2018-1000007.
CVE-2019-16370: The PGP signing plugin in Gradle before 6.0 relies on the SHA-1 algorithm, which might allow an attacker to replace an artifact with a different one that has the same SHA-1 message digest, a related issue to CVE-2005-4900.

1 issue skipped by the security teams:

CVE-2019-11065: Gradle versions from 1.4 to 5.3.1 use an insecure HTTP URL to download dependencies when the built-in JavaScript or CoffeeScript Gradle plugins are used. Dependency artifacts could have been maliciously compromised by a MITM attack against the ajax.googleapis.com web site.

Please fix them.

Created: 2019-04-11 Last update: 2019-10-21 00:30

3 security issues in bullseye high

There are 3 open security issues in bullseye.

3 important issues:

CVE-2019-15052: The HTTP client in Gradle before 5.6 sends authentication credentials originally destined for the configured host. If that host returns a 30x redirect, Gradle also sends those credentials to all subsequent hosts that the request redirects to. This is similar to CVE-2018-1000007.
CVE-2019-11065: Gradle versions from 1.4 to 5.3.1 use an insecure HTTP URL to download dependencies when the built-in JavaScript or CoffeeScript Gradle plugins are used. Dependency artifacts could have been maliciously compromised by a MITM attack against the ajax.googleapis.com web site.
CVE-2019-16370: The PGP signing plugin in Gradle before 6.0 relies on the SHA-1 algorithm, which might allow an attacker to replace an artifact with a different one that has the same SHA-1 message digest, a related issue to CVE-2005-4900.

Please fix them.

Created: 2019-07-07 Last update: 2019-10-21 00:30

3 security issues in sid high

There are 3 open security issues in sid.

3 important issues:

CVE-2019-15052: The HTTP client in Gradle before 5.6 sends authentication credentials originally destined for the configured host. If that host returns a 30x redirect, Gradle also sends those credentials to all subsequent hosts that the request redirects to. This is similar to CVE-2018-1000007.
CVE-2019-11065: Gradle versions from 1.4 to 5.3.1 use an insecure HTTP URL to download dependencies when the built-in JavaScript or CoffeeScript Gradle plugins are used. Dependency artifacts could have been maliciously compromised by a MITM attack against the ajax.googleapis.com web site.
CVE-2019-16370: The PGP signing plugin in Gradle before 6.0 relies on the SHA-1 algorithm, which might allow an attacker to replace an artifact with a different one that has the same SHA-1 message digest, a related issue to CVE-2005-4900.

Please fix them.

Created: 2019-04-11 Last update: 2019-10-21 00:30

3 security issues in stretch high

There are 3 open security issues in stretch.

2 important issues:

CVE-2019-15052: The HTTP client in Gradle before 5.6 sends authentication credentials originally destined for the configured host. If that host returns a 30x redirect, Gradle also sends those credentials to all subsequent hosts that the request redirects to. This is similar to CVE-2018-1000007.
CVE-2019-16370: The PGP signing plugin in Gradle before 6.0 relies on the SHA-1 algorithm, which might allow an attacker to replace an artifact with a different one that has the same SHA-1 message digest, a related issue to CVE-2005-4900.

1 issue skipped by the security teams:

CVE-2019-11065: Gradle versions from 1.4 to 5.3.1 use an insecure HTTP URL to download dependencies when the built-in JavaScript or CoffeeScript Gradle plugins are used. Dependency artifacts could have been maliciously compromised by a MITM attack against the ajax.googleapis.com web site.

Please fix them.

Created: 2019-04-11 Last update: 2019-10-21 00:30

Does not build reproducibly during testing normal

A package building reproducibly enables third parties to verify that the source matches the distributed binaries. It has been identified that this source package produced different results, failed to build or had other issues in a test environment. Please read about how to improve the situation!

Created: 2017-12-15 Last update: 2019-12-05 22:00

Depends on packages which need a new maintainer normal

The packages that gradle depends on which need a new maintainer are:

dh-exec (#851746)
- Build-Depends: dh-exec

Created: 2019-11-22 Last update: 2019-12-05 20:58

version in VCS is newer than in repository, is it time to upload? normal

vcswatch reports that this package seems to have a new changelog entry (version 4.4.1-9, distribution UNRELEASED) and new commits in its VCS. You should consider whether it's time to make an upload.

Here are the relevant commit messages:

commit a4c60c9ad4f62e8eabaf532686460884e847c795
Author: Emmanuel Bourg <ebourg@apache.org>
Date:   Mon Sep 16 15:22:50 2019 +0200

    Improved the reproducibility of the timestamp in build-receipt.properties

Created: 2019-09-16 Last update: 2019-11-29 19:35

lintian reports 8 warnings normal

Lintian reports 8 warnings about this package. You should make the package lintian clean getting rid of them.

Created: 2019-08-23 Last update: 2019-08-23 03:47

4 ignored security issues in jessie low

There are 4 open security issues in jessie.

4 issues skipped by the security teams:

CVE-2019-15052: The HTTP client in Gradle before 5.6 sends authentication credentials originally destined for the configured host. If that host returns a 30x redirect, Gradle also sends those credentials to all subsequent hosts that the request redirects to. This is similar to CVE-2018-1000007.
CVE-2016-6199: ObjectSocketWrapper.java in Gradle 2.12 allows remote attackers to execute arbitrary code via a crafted serialized object.
CVE-2019-11065: Gradle versions from 1.4 to 5.3.1 use an insecure HTTP URL to download dependencies when the built-in JavaScript or CoffeeScript Gradle plugins are used. Dependency artifacts could have been maliciously compromised by a MITM attack against the ajax.googleapis.com web site.
CVE-2019-16370: The PGP signing plugin in Gradle before 6.0 relies on the SHA-1 algorithm, which might allow an attacker to replace an artifact with a different one that has the same SHA-1 message digest, a related issue to CVE-2005-4900.

Please fix them.

Created: 2017-02-10 Last update: 2019-10-21 00:30

Standards version of the package is outdated. wishlist

The package should be updated to follow the last version of Debian Policy (Standards-Version 4.4.1 instead of 4.3.0).

Created: 2019-07-08 Last update: 2019-09-29 23:40

news

[rss feed]

[2019-08-10] gradle 4.4.1-8 MIGRATED to testing (Debian testing watch)
[2019-08-05] Accepted gradle 4.4.1-8 (source) into unstable (Saif Abdul Cassim) (signed by: Emmanuel Bourg)
[2019-07-09] gradle 4.4.1-7 MIGRATED to testing (Debian testing watch)
[2019-06-27] Accepted gradle 4.4.1-7 (source) into unstable (Emmanuel Bourg)
[2019-06-26] gradle 4.4.1-6 MIGRATED to testing (Debian testing watch)
[2019-06-21] Accepted gradle 4.4.1-6 (source) into unstable (Emmanuel Bourg)
[2019-03-09] gradle 4.4.1-5 MIGRATED to testing (Debian testing watch)
[2019-02-26] Accepted gradle 4.4.1-5 (source) into unstable (Andrej Shadura)
[2019-01-20] gradle 4.4.1-4 MIGRATED to testing (Debian testing watch)
[2019-01-20] gradle 4.4.1-4 MIGRATED to testing (Debian testing watch)
[2019-01-15] Accepted gradle 4.4.1-4 (source) into unstable (Emmanuel Bourg)
[2018-12-04] gradle 4.4.1-3 MIGRATED to testing (Debian testing watch)
[2018-11-29] Accepted gradle 4.4.1-3 (source) into unstable (tony mancill)
[2018-11-14] gradle 4.4.1-2 MIGRATED to testing (Debian testing watch)
[2018-11-09] Accepted gradle 4.4.1-2 (source) into unstable (Tiago Stürmer Daitx) (signed by: Emmanuel Bourg)
[2018-10-22] gradle 4.4.1-1 MIGRATED to testing (Debian testing watch)
[2018-10-22] gradle 4.4.1-1 MIGRATED to testing (Debian testing watch)
[2018-10-03] Accepted gradle 4.4.1-1 (source) into unstable (Emmanuel Bourg)
[2018-10-01] Accepted gradle 4.4-3 (source) into unstable (Emmanuel Bourg)
[2018-09-17] Accepted gradle 4.4-2 (source) into unstable (Emmanuel Bourg)
[2018-09-16] Accepted gradle 3.4.1-8 (source) into unstable (Emmanuel Bourg)
[2018-05-18] Accepted gradle 4.4-1 (source) into experimental (Kai-Chung Yan (殷啟聰)) (signed by: Kai-Chung Yan)
[2018-05-14] gradle 3.4.1-7 MIGRATED to testing (Debian testing watch)
[2018-04-11] Accepted gradle 3.4.1-7 (source all) into unstable (Markus Koschany)
[2018-04-05] Accepted gradle 3.4.1-6 (source) into unstable (Emmanuel Bourg)
[2018-04-04] Accepted gradle 3.4.1-5 (source) into unstable (Emmanuel Bourg)
[2018-03-25] Accepted gradle 3.4.1-4 (source all) into unstable (tony mancill)
[2018-03-25] Accepted gradle 3.4.1-3 (source all) into experimental (tony mancill)
[2017-11-29] Accepted gradle 3.4.1-2 (source) into experimental (Markus Koschany)
[2017-11-25] Accepted gradle 3.4.1-1 (source) into experimental (Markus Koschany)

bugs [bug history graph]

all: 11
RC: 0
I&N: 8
M&W: 3
F&P: 0
patch: 0

links

homepage
lintian (0, 8)
buildd: logs, clang, reproducibility
popcon
browse source code
edit tags
security tracker
screenshots

ubuntu

[Information about Ubuntu for Debian Developers]

version: 4.4.1-8
3 bugs