Security Flaw in Android Build Scripts for Cordova by Apache

CVE-2017-3160

What is CVE-2017-3160?

This vulnerability arises when the Cordova platform on Android fetches the Gradle executable from a non-secure HTTP URI during the initial build process. As a result, this opens the door to Man-in-the-Middle attacks, where an attacker could potentially intercept and compromise the Gradle distribution before it is used in the build. Developers are strongly encouraged to upgrade to Cordova-Android version 6.1.2 or later to ensure secure fetching of Gradle. As an immediate mitigation measure, developers can also configure the environment variable CORDOVA_ANDROID_GRADLE_DISTRIBUTION_URL to use a secure HTTPS link for fetching Gradle.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References