Path traversal vulnerabilities in handling of Tar archives in Gradle

CVE-2023-35947

What is CVE-2023-35947?

This vulnerability in Gradle allows for path traversal when unpacking Tar archives. If not properly managed, important files may be overwritten anywhere the Gradle process has write permissions, leading to potential data exposure. An attacker could exploit this by controlling either a build's source archive or manipulating the build configuration to include a malicious Tar archive. This risk manifests particularly if the attacker has access to a remote build cache server or can intercept communications with the build cache. Affected users should upgrade to Gradle versions 7.6.2 or 8.2 or later, which implement checks to deny handling Tar archives containing path traversal elements.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References