Skip to content
Fencer Vulns
medium 6.6

CVE-2022-31156 json

Gradle's dependency verification can ignore checksum verification when signature verification cannot be performed

published 2022-07-14 4 y ago modified 2026-09-08 2 mo ago also BIT-gradle-2022-31156 , EUVD-2022-52772 , GHSA-j6wc-xfg8-jx2j

cvss
6.6
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.6%
EPSS 0.6% chance of exploitation in 30 days, percentile 46%
public exploits
0
none known

Summary

Gradle is a build tool. Dependency verification is a security feature in Gradle Build Tool that was introduced to allow validation of external dependencies either through their checksum or cryptographic signatures. In versions 6.2 through 7.4.2, there are some cases in which Gradle may skip that verification and accept a dependency that would otherwise fail the build as an untrusted external artifact. This can occur in two ways. When signature verification is disabled but the verification metadata contains entries for dependencies that only have a `gpg` element but no `checksum` element. When signature verification is enabled, the verification metadata contains entries for dependencies with a `gpg` element but there is no signature file on the remote repository. In both cases, the verification will accept the dependency, skipping signature verification and not complaining that the dependency has no checksum entry. For builds that are vulnerable, there are two risks. Gradle could download a malicious binary from a repository outside your organization due to name squatting. For those still using HTTP only and not HTTPS for downloading dependencies, the build could download a malicious library instead of the expected one. Gradle 7.5 patches this issue by making sure to run checksum verification if signature verification cannot be completed, whatever the reason. Two workarounds are available: Remove all `gpg` elements from dependency verification metadata if you disable signature validation and/or avoid adding `gpg` entries for dependencies that do not have signature files.

Patch / fix

  • bitnami gradle 7.5.0
  • gradle gradle 7.5.0

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2022-31156 updated cvss 4.4

gradle: Dependency verification can ignore checksum verification when signature verification cannot be performed

  • Red Hat JBoss Enterprise Application Platform 6 gradle gradle
    affected: workaround, no fix planned “- Remove all gpg elements from dependency verification metadata if you disable signature validation. - Do not add gpg entries for dependencies that do not have signature files.”
  • Red Hat Software Collections rh-maven36-byte-buddy, rh-maven36-byte-buddy-agent, rh-maven36-byte-buddy-parent, rh-maven36-byte-buddy-javadoc, rh-maven36-byte-buddy-maven-plugin
    affected: workaround, no fix available “- Remove all gpg elements from dependency verification metadata if you disable signature validation. - Do not add gpg entries for dependencies that do not have signature files.”
  • Red Hat JBoss Enterprise Application Platform 7 gradle gradle Red Hat JBoss Enterprise Application Platform Expansion Pack gradle gradle
    not affected: vulnerable code not present “- Remove all gpg elements from dependency verification metadata if you disable signature validation. - Do not add gpg entries for dependencies that do not have signature files.”

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
total
Assessed
18 mo ago

Exploit prediction

0.56% chance of exploitation in the next 30 days, higher than 46% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 6.6 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
NVD 3.1 4.4 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:H/A:N
OSV 3.1 4.4 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:H/A:N

Affected packages

ecosystem package affected fixed in
bitnami gradle
>=6.2.0, <7.5.0
7.5.0

Affected products

  • gradle gradle

Classification

Weakness
  • CWE-829 Inclusion of Functionality from Untrusted Control Sphere
  • CWE-347 Improper Verification of Cryptographic Signature

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.