Skip to content

Commit

Permalink
vuln-fix: Use HTTPS instead of HTTP to resolve dependencies
Browse files Browse the repository at this point in the history
This fixes a security vulnerability in this project where the `build.gradle`
files were configuring Gradle to resolve dependencies over HTTP instead of
HTTPS.

Weakness: CWE-829: Inclusion of Functionality from Untrusted Control Sphere
Severity: High
CVSSS: 8.1
Detection: OpenRewrite

Reported-by: Jonathan Leitschuh <Jonathan.Leitschuh@gmail.com>
Signed-off-by: Jonathan Leitschuh <Jonathan.Leitschuh@gmail.com>

Bug-tracker: JLLeitschuh/security-research#9


Co-authored-by: Moderne <team@moderne.io>
  • Loading branch information
JLLeitschuh and TeamModerne committed Oct 3, 2022
1 parent b192ac2 commit d317e59
Showing 1 changed file with 6 additions and 6 deletions.
12 changes: 6 additions & 6 deletions build.gradle
Original file line number Diff line number Diff line change
Expand Up @@ -4,9 +4,9 @@ buildscript {

repositories {
if (project['CERN_VM']) {
maven { url 'http://artifactory.cern.ch/ds-jcenter' }
maven { url 'http://artifactory.cern.ch/development' }
maven { url 'http://artifactory.cern.ch/gradle-plugins' }
maven { url 'https://artifactory.cern.ch/ds-jcenter' }
maven { url 'https://artifactory.cern.ch/development' }
maven { url 'https://artifactory.cern.ch/gradle-plugins' }
} else {
gradlePluginPortal()
}
Expand All @@ -29,8 +29,8 @@ sourceCompatibility = JavaVersion.VERSION_1_8

repositories {
if (project['CERN_VM']) {
maven { url 'http://artifactory.cern.ch/ds-jcenter' }
maven { url 'http://artifactory.cern.ch/development' }
maven { url 'https://artifactory.cern.ch/ds-jcenter' }
maven { url 'https://artifactory.cern.ch/development' }
} else {
mavenCentral()
}
Expand Down Expand Up @@ -130,4 +130,4 @@ if (!project['CERN_VM']) {
if (project['DEPLOYMENT']) {
println 'Applying deployment scripts'
apply from: 'https://raw.githubusercontent.com/ossgang/gradle-scripts/master/deployment/deploy-to-maven-central.gradle'
}
}

0 comments on commit d317e59

Please sign in to comment.