Bug#926923: gradle: CVE-2019-11065

[Sylvain Beucler]

Package: gradle
Version: 4.4.1-5
X-Debbugs-CC: team at security.debian.org
Severity: grave
Tags: security

Hi,

The following vulnerability was published for gradle.

CVE-2019-11065[0]:
| Gradle versions from 1.4 to 5.3.1 use an insecure HTTP URL to download
| dependencies when the built-in JavaScript or CoffeeScript Gradle
| plugins are used. Dependency artifacts could have been maliciously
| compromised by a MITM attack against the ajax.googleapis.com web site.


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2019-11065
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11065
    https://github.com/gradle/gradle/pull/8927

Cheers!
Sylvain Beucler