{
	"document":{
		"aggregate_severity":{
			"namespace":"https://nvd.nist.gov/vuln-metrics/cvss",
			"text":"Medium"
		},
		"category":"csaf_vex",
		"csaf_version":"2.0",
		"distribution":{
			"tlp":{
				"label":"WHITE",
				"url":"https:/www.first.org/tlp/"
			}
		},
		"lang":"en",
		"notes":[
			{
				"text":"gradle security update",
				"category":"general",
				"title":"Synopsis"
			},
			{
				"text":"An update for gradle is now available for openEuler-20.03-LTS-SP1 and openEuler-20.03-LTS-SP2.",
				"category":"general",
				"title":"Summary"
			},
			{
				"text":"Gradle is build automation evolved. Gradle can automate the building, testing, publishing, deployment and more of software packages or other types of projects such as generated static websites, generated documentation or indeed anything else. Gradle combines the power and flexibility of Ant with the dependency management and conventions of Maven into a more effective way to build. Powered by a Groovy DSL and packed with innovation, Gradle provides a declarative way to describe all kinds of builds through sensible defaults. Gradle is quickly becoming the build system of choice for many open source projects, leading edge enterprises and legacy automation challenges.\n\nSecurity Fix(es):\n\nThe PGP signing plugin in Gradle before 6.0 relies on the SHA-1 algorithm, which might allow an attacker to replace an artifact with a different one that has the same SHA-1 message digest, a related issue to CVE-2005-4900.(CVE-2019-16370)",
				"category":"general",
				"title":"Description"
			},
			{
				"text":"An update for gradle is now available for openEuler-20.03-LTS-SP1 and openEuler-20.03-LTS-SP2.\n\nopenEuler Security has rated this update as having a security impact of medium. A Common Vunlnerability Scoring System(CVSS)base score,which gives a detailed severity rating, is available for each vulnerability from the CVElink(s) in the References section.",
				"category":"general",
				"title":"Topic"
			},
			{
				"text":"Medium",
				"category":"general",
				"title":"Severity"
			},
			{
				"text":"gradle",
				"category":"general",
				"title":"Affected Component"
			}
		],
		"publisher":{
			"issuing_authority":"openEuler security committee",
			"name":"openEuler",
			"namespace":"https://www.openeuler.org",
			"contact_details":"openeuler-security@openeuler.org",
			"category":"vendor"
		},
		"references":[
			{
				"summary":"openEuler-SA-2021-1309",
				"category":"self",
				"url":"https://openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2021-1309"
			},
			{
				"summary":"CVE-2019-16370",
				"category":"self",
				"url":"https://openeuler.org/en/security/cve/detail?cveId=CVE-2019-16370&packageName=gradle"
			},
			{
				"summary":"nvd cve",
				"category":"external",
				"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-16370"
			},
			{
				"summary":"openEuler-SA-2021-1309 vex file",
				"category":"self",
				"url":"https://repo.openeuler.org/security/data/csaf/advisories/2021/csaf-openeuler-sa-2021-1309.json"
			}
		],
		"title":"An update for gradle is now available for openEuler-20.03-LTS-SP1 and openEuler-20.03-LTS-SP2",
		"tracking":{
			"initial_release_date":"2021-08-14T09:21:47+08:00",
			"revision_history":[
				{
					"date":"2021-08-14T09:21:47+08:00",
					"summary":"Initial",
					"number":"1.0.0"
				},
				{
					"date":"2024-10-31T09:21:47+08:00",
					"summary":"final",
					"number":"2.0.0"
				}
			],
			"generator":{
				"date":"2024-10-31T09:21:47+08:00",
				"engine":{
					"name":"openEuler CSAF Tool V1.0"
				}
			},
			"current_release_date":"2024-10-31T09:21:47+08:00",
			"id":"openEuler-SA-2021-1309",
			"version":"2.0.0",
			"status":"final"
		}
	},
	"product_tree":{
		"branches":[
			{
				"name":"openEuler",
				"category":"vendor",
				"branches":[
					{
						"name":"openEuler",
						"branches":[
							{
								"product":{
									"product_identification_helper":{
										"cpe":"cpe:/a:openEuler:openEuler:20.03-LTS-SP1"
									},
									"product_id":"openEuler-20.03-LTS-SP1",
									"name":"openEuler-20.03-LTS-SP1"
								},
								"name":"openEuler-20.03-LTS-SP1",
								"category":"product_version"
							},
							{
								"product":{
									"product_identification_helper":{
										"cpe":"cpe:/a:openEuler:openEuler:20.03-LTS-SP2"
									},
									"product_id":"openEuler-20.03-LTS-SP2",
									"name":"openEuler-20.03-LTS-SP2"
								},
								"name":"openEuler-20.03-LTS-SP2",
								"category":"product_version"
							}
						],
						"category":"product_name"
					},
					{
						"name":"noarch",
						"branches":[
							{
								"product":{
									"product_identification_helper":{
										"cpe":"cpe:/a:openEuler:openEuler:20.03-LTS-SP1"
									},
									"product_id":"gradle-4.4.1-2.oe1.noarch.rpm(20.03-LTS-SP1)",
									"name":"gradle-4.4.1-2.oe1.noarch.rpm"
								},
								"name":"gradle-4.4.1-2.oe1.noarch.rpm",
								"category":"product_version"
							},
							{
								"product":{
									"product_identification_helper":{
										"cpe":"cpe:/a:openEuler:openEuler:20.03-LTS-SP2"
									},
									"product_id":"gradle-4.4.1-2.oe1.noarch.rpm(20.03-LTS-SP2)",
									"name":"gradle-4.4.1-2.oe1.noarch.rpm"
								},
								"name":"gradle-4.4.1-2.oe1.noarch.rpm",
								"category":"product_version"
							}
						],
						"category":"architecture"
					},
					{
						"name":"src",
						"branches":[
							{
								"product":{
									"product_identification_helper":{
										"cpe":"cpe:/a:openEuler:openEuler:20.03-LTS-SP1"
									},
									"product_id":"gradle-4.4.1-2.oe1.src.rpm(20.03-LTS-SP1)",
									"name":"gradle-4.4.1-2.oe1.src.rpm"
								},
								"name":"gradle-4.4.1-2.oe1.src.rpm",
								"category":"product_version"
							},
							{
								"product":{
									"product_identification_helper":{
										"cpe":"cpe:/a:openEuler:openEuler:20.03-LTS-SP2"
									},
									"product_id":"gradle-4.4.1-2.oe1.src.rpm(20.03-LTS-SP2)",
									"name":"gradle-4.4.1-2.oe1.src.rpm"
								},
								"name":"gradle-4.4.1-2.oe1.src.rpm",
								"category":"product_version"
							}
						],
						"category":"architecture"
					}
				]
			}
		],
		"relationships":[
			{
				"relates_to_product_reference":"openEuler-20.03-LTS-SP1",
				"product_reference":"gradle-4.4.1-2.oe1.noarch.rpm(20.03-LTS-SP1)",
				"full_product_name":{
					"product_id":"openEuler-20.03-LTS-SP1:gradle-4.4.1-2.oe1.noarch",
					"name":"gradle-4.4.1-2.oe1.noarch as a component of openEuler-20.03-LTS-SP1"
				},
				"category":"default_component_of"
			},
			{
				"relates_to_product_reference":"openEuler-20.03-LTS-SP2",
				"product_reference":"gradle-4.4.1-2.oe1.noarch.rpm(20.03-LTS-SP2)",
				"full_product_name":{
					"product_id":"openEuler-20.03-LTS-SP2:gradle-4.4.1-2.oe1.noarch",
					"name":"gradle-4.4.1-2.oe1.noarch as a component of openEuler-20.03-LTS-SP2"
				},
				"category":"default_component_of"
			},
			{
				"relates_to_product_reference":"openEuler-20.03-LTS-SP1",
				"product_reference":"gradle-4.4.1-2.oe1.src.rpm(20.03-LTS-SP1)",
				"full_product_name":{
					"product_id":"openEuler-20.03-LTS-SP1:gradle-4.4.1-2.oe1.src",
					"name":"gradle-4.4.1-2.oe1.src as a component of openEuler-20.03-LTS-SP1"
				},
				"category":"default_component_of"
			},
			{
				"relates_to_product_reference":"openEuler-20.03-LTS-SP2",
				"product_reference":"gradle-4.4.1-2.oe1.src.rpm(20.03-LTS-SP2)",
				"full_product_name":{
					"product_id":"openEuler-20.03-LTS-SP2:gradle-4.4.1-2.oe1.src",
					"name":"gradle-4.4.1-2.oe1.src as a component of openEuler-20.03-LTS-SP2"
				},
				"category":"default_component_of"
			}
		]
	},
	"vulnerabilities":[
		{
			"cve":"CVE-2019-16370",
			"notes":[
				{
					"text":"The PGP signing plugin in Gradle before 6.0 relies on the SHA-1 algorithm, which might allow an attacker to replace an artifact with a different one that has the same SHA-1 message digest, a related issue to CVE-2005-4900.",
					"category":"description",
					"title":"Vulnerability Description"
				}
			],
			"product_status":{
				"fixed":[
					"openEuler-20.03-LTS-SP1:gradle-4.4.1-2.oe1.noarch",
					"openEuler-20.03-LTS-SP2:gradle-4.4.1-2.oe1.noarch",
					"openEuler-20.03-LTS-SP1:gradle-4.4.1-2.oe1.src",
					"openEuler-20.03-LTS-SP2:gradle-4.4.1-2.oe1.src"
				]
			},
			"remediations":[
				{
					"product_ids":[
						"openEuler-20.03-LTS-SP1:gradle-4.4.1-2.oe1.noarch",
						"openEuler-20.03-LTS-SP2:gradle-4.4.1-2.oe1.noarch",
						"openEuler-20.03-LTS-SP1:gradle-4.4.1-2.oe1.src",
						"openEuler-20.03-LTS-SP2:gradle-4.4.1-2.oe1.src"
					],
					"details":"gradle security update",
					"category":"vendor_fix",
					"url":"https://openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2021-1309"
				}
			],
			"scores":[
				{
					"cvss_v3":{
						"baseSeverity":"MEDIUM",
						"baseScore":5.9,
						"vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N",
						"version":"3.1"
					},
					"products":[
						"openEuler-20.03-LTS-SP1:gradle-4.4.1-2.oe1.noarch",
						"openEuler-20.03-LTS-SP2:gradle-4.4.1-2.oe1.noarch",
						"openEuler-20.03-LTS-SP1:gradle-4.4.1-2.oe1.src",
						"openEuler-20.03-LTS-SP2:gradle-4.4.1-2.oe1.src"
					]
				}
			],
			"threats":[
				{
					"details":"Medium",
					"category":"impact"
				}
			],
			"title":"CVE-2019-16370"
		}
	]
}