In Gradle before version 7.0, files created with open permissions in the system temporary directory can allow an attacker to access information downloaded by Gradle. Some builds could be vulnerable to a local information disclosure. Remote files accessed through TextResourceFactory are downloaded into the system temporary directory first. Sensitive information contained in these files can be exposed to other local users on the same system. If you do not use the `TextResourceFactory` API, you are not vulnerable. As of Gradle 7.0, uses of the system temporary directory have been moved to the Gradle User Home directory. By default, this directory is restricted to the user running the build. As a workaround, set a more restrictive umask that removes read access to other users. When files are created in the system temporary directory, they will not be accessible to other users. If you are unable to change your system's umask, you can move the Java temporary directory by setting the System Property `java.io.tmpdir`. The new path needs to limit permissions to the build user only.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - In Gradle before version 7.0, files created with open permissions in the system temporary directory can     allow an attacker to access information downloaded by Gradle. Some builds could be vulnerable to a local     information disclosure. Remote files accessed through TextResourceFactory are downloaded into the system     temporary directory first. Sensitive information contained in these files can be exposed to other local     users on the same system. If you do not use the `TextResourceFactory` API, you are not vulnerable. As of     Gradle 7.0, uses of the system temporary directory have been moved to the Gradle User Home directory. By     default, this directory is restricted to the user running the build. As a workaround, set a more     restrictive umask that removes read access to other users. When files are created in the system temporary     directory, they will not be accessible to other users. If you are unable to change your system's umask,     you can move the Java temporary directory by setting the System Property `java.io.tmpdir`. The new path     needs to limit permissions to the build user only. (CVE-2021-29429)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:1119-1 advisory.

  - The HTTP client in Gradle before 5.6 sends authentication credentials originally destined for the     configured host. If that host returns a 30x redirect, Gradle also sends those credentials to all     subsequent hosts that the request redirects to. This is similar to CVE-2018-1000007. (CVE-2019-15052)

  - In Gradle before version 7.0, files created with open permissions in the system temporary directory can     allow an attacker to access information downloaded by Gradle. Some builds could be vulnerable to a local     information disclosure. Remote files accessed through TextResourceFactory are downloaded into the system     temporary directory first. Sensitive information contained in these files can be exposed to other local     users on the same system. If you do not use the `TextResourceFactory` API, you are not vulnerable. As of     Gradle 7.0, uses of the system temporary directory have been moved to the Gradle User Home directory. By     default, this directory is restricted to the user running the build. As a workaround, set a more     restrictive umask that removes read access to other users. When files are created in the system temporary     directory, they will not be accessible to other users. If you are unable to change your system's umask,     you can move the Java temporary directory by setting the System Property `java.io.tmpdir`. The new path     needs to limit permissions to the build user only. (CVE-2021-29429)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
253268	Linux Distros Unpatched Vulnerability : CVE-2021-29429	Nessus	Misc.	medium
192987	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : gradle, gradle-bootstrap (SUSE-SU-2024:1119-1)	Nessus	SuSE Local Security Checks	critical

Detections

Analytics

CVE-2021-29429

medium

Tenable Plugins

medium

critical