CVE-2023-35947

一、漏洞信息
 漏洞编号：[CVE-2023-35947](https://nvd.nist.gov/vuln/detail/CVE-2023-35947)
 漏洞归属组件：[gradle](https://gitee.com/src-openeuler/gradle)
 漏洞归属的版本：4.4.1
 CVSS V3.0分值：
  BaseScore：8.1 High
  Vector：CVSS：3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
 漏洞简述：
  Gradle is a build tool with a focus on build automation and support for multi-language development. In affected versions when unpacking Tar archives, Gradle did not check that files could be written outside of the unpack location. This could lead to important files being overwritten anywhere the Gradle process has write permissions. For a build reading Tar entries from a Tar archive, this issue could allow Gradle to disclose information from sensitive files through an arbitrary file read. To exploit this behavior, an attacker needs to either control the source of an archive already used by the build or modify the build to interact with a malicious archive. It is unlikely that this would go unnoticed. A fix has been released in Gradle 7.6.2 and 8.2 to protect against this vulnerability. Starting from these versions, Gradle will refuse to handle Tar archives which contain path traversal elements in a Tar entry name. Users are advised to upgrade. There are no known workarounds for this vulnerability.### ImpactThis is a path traversal vulnerability when Gradle deals with Tar archives, often referenced as TarSlip, a variant of ZipSlip.* When unpacking Tar archives, Gradle did not check that files could be written outside of the unpack location. This could lead to important files being overwritten anywhere the Gradle process has write permissions.* For a build reading Tar entries from a Tar archive, this issue could allow Gradle to disclose information from sensitive files through an arbitrary file read.To exploit this behavior, an attacker needs to either control the source of an archive already used by the build or modify the build to interact with a malicious archive. It is unlikely that this would go unnoticed.Gradle uses Tar archives for its [Build Cache](https://docs.gradle.org/current/userguide/build_cache.html). These archives are safe when created by Gradle. But if an attacker had control of a remote build cache server, they could inject malicious build cache entries that leverage this vulnerability. This attack vector could also be exploited if a man-in-the-middle can be performed between the remote cache and the build.### PatchesA fix has been released in Gradle 7.6.2 and 8.2 to protect against this vulnerability. Starting from these versions, Gradle will refuse to handle Tar archives which contain path traversal elements in a Tar entry name.It is recommended that users upgrade to a patched version.### WorkaroundsThere is no workaround.* If your build deals with Tar archives that you do not fully trust, you need to inspect them to confirm they do not attempt to leverage this vulnerability.* If you use the Gradle remote build cache, make sure only trusted parties have write access to it and that connections to the remote cache are properly secured.### References* [CWE-22: Improper Limitation of a Pathname to a Restricted Directory ( Path Traversal )](https://cwe.mitre.org/data/definitions/22.html)* [Gradle Build Cache](https://docs.gradle.org/current/userguide/build_cache.html)* [ZipSlip](https://security.snyk.io/research/zip-slip-vulnerability)
 漏洞公开时间：2023-07-01 05:15:09
 漏洞创建时间：2025-04-01 16:15:15
 漏洞详情参考链接：
  https://nvd.nist.gov/vuln/detail/CVE-2023-35947
<details>
<summary>更多参考(点击展开)</summary>

| 参考来源 | 参考链接 | 来源链接 |
| ------- | -------- | -------- |
| security-advisories.github.com | https://github.com/gradle/gradle/commit/1096b309520a8c315e3b6109a6526de4eabcb879 |  |
| security-advisories.github.com | https://github.com/gradle/gradle/commit/2e5c34d57d0c0b7f0e8b039a192b91e5c8249d91 |  |
| security-advisories.github.com | https://github.com/gradle/gradle/security/advisories/GHSA-84mw-qh6q-v842 |  |
| security-advisories.github.com | https://security.netapp.com/advisory/ntap-20230803-0007/ |  |
| af854a3a-2127-422b-91ae-364da2661108 | https://github.com/gradle/gradle/commit/1096b309520a8c315e3b6109a6526de4eabcb879 |  |
| af854a3a-2127-422b-91ae-364da2661108 | https://github.com/gradle/gradle/commit/2e5c34d57d0c0b7f0e8b039a192b91e5c8249d91 |  |
| af854a3a-2127-422b-91ae-364da2661108 | https://github.com/gradle/gradle/security/advisories/GHSA-84mw-qh6q-v842 |  |
| af854a3a-2127-422b-91ae-364da2661108 | https://security.netapp.com/advisory/ntap-20230803-0007/ |  |
| suse_bugzilla | https://cwe.mitre.org/data/definitions/22.html | https://bugzilla.suse.com/show_bug.cgi?id=1212931 |
| suse_bugzilla | https://docs.gradle.org/current/userguide/build_cache.html | https://bugzilla.suse.com/show_bug.cgi?id=1212931 |
| suse_bugzilla | https://security.snyk.io/research/zip-slip-vulnerability | https://bugzilla.suse.com/show_bug.cgi?id=1212931 |
| suse_bugzilla | http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-35947 | https://bugzilla.suse.com/show_bug.cgi?id=1212931 |
| suse_bugzilla | https://www.cve.org/CVERecord?id=CVE-2023-35947 | https://bugzilla.suse.com/show_bug.cgi?id=1212931 |
| suse_bugzilla | https://github.com/gradle/gradle/commit/1096b309520a8c315e3b6109a6526de4eabcb879 | https://bugzilla.suse.com/show_bug.cgi?id=1212931 |
| suse_bugzilla | https://github.com/gradle/gradle/commit/2e5c34d57d0c0b7f0e8b039a192b91e5c8249d91 | https://bugzilla.suse.com/show_bug.cgi?id=1212931 |
| suse_bugzilla | https://github.com/gradle/gradle/security/advisories/GHSA-84mw-qh6q-v842 | https://bugzilla.suse.com/show_bug.cgi?id=1212931 |
| redhat_bugzilla | https://github.com/gradle/gradle/commit/1096b309520a8c315e3b6109a6526de4eabcb879 | https://bugzilla.redhat.com/show_bug.cgi?id=2219506 |
| redhat_bugzilla | https://github.com/gradle/gradle/security/advisories/GHSA-84mw-qh6q-v842 | https://bugzilla.redhat.com/show_bug.cgi?id=2219506 |
| redhat_bugzilla | https://github.com/gradle/gradle/commit/2e5c34d57d0c0b7f0e8b039a192b91e5c8249d91 | https://bugzilla.redhat.com/show_bug.cgi?id=2219506 |
| debian |  | https://security-tracker.debian.org/tracker/CVE-2023-35947 |
| cve_search |  | https://github.com/gradle/gradle/commit/1096b309520a8c315e3b6109a6526de4eabcb879 |
| cve_search |  | https://github.com/gradle/gradle/security/advisories/GHSA-84mw-qh6q-v842 |
| cve_search |  | https://github.com/gradle/gradle/commit/2e5c34d57d0c0b7f0e8b039a192b91e5c8249d91 |
| cve_search |  | https://security.netapp.com/advisory/ntap-20230803-0007/ |
| snyk | https://github.com/gradle/gradle/commit/1096b309520a8c315e3b6109a6526de4eabcb879 | https://security.snyk.io/vuln/SNYK-JAVA-ORGGRADLE-5750785 |
| snyk | https://github.com/gradle/gradle/commit/2e5c34d57d0c0b7f0e8b039a192b91e5c8249d91 | https://security.snyk.io/vuln/SNYK-JAVA-ORGGRADLE-5750785 |

</details>

漏洞分析指导链接：
  https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md
 漏洞数据来源:
  openBrain开源漏洞感知系统
 漏洞补丁信息：
  <details>
<summary>详情(点击展开)</summary>

| 影响的包 | 修复版本 | 修复补丁 | 问题引入补丁 | 来源  |
| ------- | -------- | ------- | -------- | --------- |
|  |  | https://github.com/gradle/gradle/commit/1096b309520a8c315e3b6109a6526de4eabcb879 |  | security-advisories.github.com |
|  |  | https://github.com/gradle/gradle/commit/2e5c34d57d0c0b7f0e8b039a192b91e5c8249d91 |  | security-advisories.github.com |
|  |  | https://github.com/gradle/gradle/commit/1096b309520a8c315e3b6109a6526de4eabcb879 |  | af854a3a-2127-422b-91ae-364da2661108 |
|  |  | https://github.com/gradle/gradle/commit/2e5c34d57d0c0b7f0e8b039a192b91e5c8249d91 |  | af854a3a-2127-422b-91ae-364da2661108 |
|  |  | https://github.com/gradle/gradle/commit/1096b309520a8c315e3b6109a6526de4eabcb879 |  | suse_bugzilla |
|  |  | https://github.com/gradle/gradle/commit/2e5c34d57d0c0b7f0e8b039a192b91e5c8249d91 |  | suse_bugzilla |
|  |  | https://github.com/gradle/gradle/commit/1096b309520a8c315e3b6109a6526de4eabcb879 |  | redhat_bugzilla |
|  |  | https://github.com/gradle/gradle/commit/2e5c34d57d0c0b7f0e8b039a192b91e5c8249d91 |  | redhat_bugzilla |
|  |  | https://github.com/gradle/gradle/commit/1096b309520a8c315e3b6109a6526de4eabcb879 |  | snyk |
|  |  | https://github.com/gradle/gradle/commit/2e5c34d57d0c0b7f0e8b039a192b91e5c8249d91 |  | snyk |
|  |  | https://github.com/gradle/gradle/commit/1096b309520a8c315e3b6109a6526de4eabcb879 |  | nvd |
|  |  | https://github.com/gradle/gradle/commit/2e5c34d57d0c0b7f0e8b039a192b91e5c8249d91 |  | nvd |
|  |  | https://github.com/gradle/gradle/security/advisories/GHSA-84mw-qh6q-v842 |  | nvd |
|  |  | https://security.netapp.com/advisory/ntap-20230803-0007/ |  | nvd |

</details>

二、漏洞分析结构反馈
 影响性分析说明：
                            Gradle 是一款构建工具，专注于构建自动化，支持多语言开发。在受影响的版本中，Gradle 在解压 Tar 档案时未检查文件是否可以在解压位置之外写入。这可能导致重要文件在 Gradle 进程具有写入权限的任何地方被覆盖。对于从 Tar 档案中读取 Tar 条目的构建，此问题可能允许 Gradle 通过任意文件读取泄露敏感文件信息。要利用此行为，攻击者需要控制构建已使用的档案来源，或者修改构建以与恶意档案交互。这不太可能被忽视。Gradle 7.6.2 和 8.2 中已发布修复程序来防御此漏洞。从这些版本开始，Gradle 将拒绝处理 Tar 条目名称中包含路径遍历元素的 Tar 档案。建议用户升级。目前尚无针对此漏洞的已知解决方法。### 影响这是 Gradle 处理 Tar 档案时的一个路径遍历漏洞，通常称为 TarSlip，是 ZipSlip 的一种变体。* 解压 Tar 档案时，Gradle 未检查文件是否可以在解压位置之外写入。这可能导致重要文件在 Gradle 进程具有写入权限的任何地方被覆盖。* 对于从 Tar 档案中读取 Tar 条目的构建，此问题可能允许 Gradle 通过任意文件读取泄露敏感文件中的信息。要利用此行为，攻击者需要控制构建已使用的档案的来源，或者修改构建以与恶意档案交互。这不太可能被忽视。Gradle 使用 Tar 档案作为其构建缓存。这些档案由 Gradle 创建时是安全的。但如果攻击者控制了远程构建缓存服务器，他们就可以注入利用此漏洞的恶意构建缓存条目。如果可以在远程缓存和构建之间执行中间人攻击，则也可以利用此攻击媒介。### 补丁Gradle 7.6.2 和 8.2 中发布了修复程序来防范此漏洞。从这些版本开始，Gradle 将拒绝处理 Tar 条目名称中包含路径遍历元素的 Tar 档案。建议用户升级到修补版本。### 解决方法没有解决方法。* 如果您的构建处理了您不完全信任的 Tar 档案，则需要检查它们以确认它们没有尝试利用此漏洞。* 如果您使用 Gradle 远程构建缓存，请确保只有受信任的各方才对其具有写访问权限，并且与远程缓存的连接得到适当的保护。### 参考文献* CWE-22:将路径名不当限制为受限目录（路径遍历）* Gradle 构建缓存* ZipSlipopenEuler 评分:6.9 中等向量:CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:C/C:L/I:H/A:L             
 openEuler评分：
  6.9
 Vector：CVSS：3.0/AV:L/AC:H/PR:N/UI:R/S:C/C:L/I:H/A:L
 受影响版本排查(受影响/不受影响)：
  1.master(4.4.1):受影响
2.openEuler-20.03-LTS-SP4(4.4.1):受影响
3.openEuler-22.03-LTS-SP3(4.4.1):受影响
4.openEuler-22.03-LTS-SP4(4.4.1):受影响
5.openEuler-24.03-LTS(4.4.1):受影响
6.openEuler-24.03-LTS-Next(4.4.1):受影响
7.openEuler-24.03-LTS-SP1(4.4.1):受影响
8.openEuler-24.03-LTS-SP2(4.4.1):受影响

修复是否涉及abi变化(是/否)：
  1.master(4.4.1):否
2.openEuler-20.03-LTS-SP4(4.4.1):否
3.openEuler-22.03-LTS-SP3(4.4.1):否
4.openEuler-22.03-LTS-SP4(4.4.1):否
5.openEuler-24.03-LTS(4.4.1):否
6.openEuler-24.03-LTS-Next(4.4.1):否
7.openEuler-24.03-LTS-SP1(4.4.1):否
8.openEuler-24.03-LTS-SP2(4.4.1):否

原因说明：
  1.master(4.4.1):正常修复
2.openEuler-20.03-LTS-SP4(4.4.1):正常修复
3.openEuler-22.03-LTS-SP3(4.4.1):正常修复
4.openEuler-22.03-LTS-SP4(4.4.1):正常修复
5.openEuler-24.03-LTS(4.4.1):正常修复
6.openEuler-24.03-LTS-Next(4.4.1):正常修复
7.openEuler-24.03-LTS-SP1(4.4.1):正常修复
8.openEuler-24.03-LTS-SP2(4.4.1):正常修复

src-openEuler/gradle
关闭

内容风险标识

评论 (19)

src-openEuler/gradle关闭 .gitee-modal { width: 500px !important; }

内容风险标识

CVE-2023-35947

评论 (19)

搜索帮助

src-openEuler/gradle
关闭