Hi,

The following vulnerability was published for gradle.

CVE-2019-16370[0]:
| The PGP signing plugin in Gradle before 6.0 relies on the SHA-1
| algorithm, which might allow an attacker to replace an artifact with a
| different one that has the same SHA-1 message digest, a related issue
| to CVE-2005-4900.


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2019-16370
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-16370
[1] https://github.com/gradle/gradle/pull/10543
[2] https://github.com/gradle/gradle/commit/425b2b7a50cd84106a77cdf1ab665c89c6b14d2f

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore

Hello,

Bug #941186 in gradle reported by you has been fixed in the
Git repository and is awaiting an upload. You can see the commit
message below and you can check the diff of the fix at:

https://salsa.debian.org/java-team/gradle/-/commit/dd78c4c4355ec11bda2caec9122491e20ee948ff

(this message was generated automatically)
-- 
Greetings

https://bugs.debian.org/941186

We believe that the bug you reported is fixed in the latest version of
gradle, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 941186@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Emmanuel Bourg <ebourg@apache.org> (supplier of updated gradle package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Sun, 22 Jan 2023 01:05:45 +0100
Source: gradle
Architecture: source
Version: 4.4.1-18
Distribution: unstable
Urgency: medium
Maintainer: Debian Java Maintainers <pkg-java-maintainers@lists.alioth.debian.org>
Changed-By: Emmanuel Bourg <ebourg@apache.org>
Closes: 941186
Changes:
 gradle (4.4.1-18) unstable; urgency=medium
 .
   * Team upload.
   * Fixed CVE-2019-16370: No longer use SHA-1 for PGP signing (Closes: #941186)
Checksums-Sha1:
 bb6f0f86f574daabb3825493850c84949ddfd009 3293 gradle_4.4.1-18.dsc
 297415b2a339aa94c64c5e3b1b9e5bf4793d7d9c 60352 gradle_4.4.1-18.debian.tar.xz
 b3260bfafa90d7a5045eac2b86e538094a1fa037 17402 gradle_4.4.1-18_source.buildinfo
Checksums-Sha256:
 23bc48ae57f85c4cbe50af88c3222344f2ef1882b6f70669bd7628335439e84a 3293 gradle_4.4.1-18.dsc
 b3c44c413c87805a62e75d6cd5257e8fccb76422d525ce107ca7a1b738a51546 60352 gradle_4.4.1-18.debian.tar.xz
 c29eec975542abdc063e5009b5df5d83e3e806cb5163edcdd73848e52eec1108 17402 gradle_4.4.1-18_source.buildinfo
Files:
 f8623bed6b354a9420e4cb206b282d32 3293 java optional gradle_4.4.1-18.dsc
 cf7b63a784ab0422142ff336412a0c1e 60352 java optional gradle_4.4.1-18.debian.tar.xz
 f5310be0f7a53f550364d050ae818d08 17402 java optional gradle_4.4.1-18_source.buildinfo
-----BEGIN PGP SIGNATURE-----

iQJGBAEBCgAwFiEEuM5N4hCA3PkD4WxA9RPEGeS50KwFAmPMhp8SHGVib3VyZ0Bh
cGFjaGUub3JnAAoJEPUTxBnkudCsHW0QAIQVz7EOiap+zOb679n/lkqqHzukS6ZN
CLkDnblAdSxUpalevSEIdWmpzaNmBnR3eMGqW0SgK+1lh9gh5wmOTzXUwZ3nyuug
HZN2NtDFXE9269StsC4saOp+fMbJ2no5hxm/fccmWbjtd7jncyIElyrsr40JDlz0
2c0Yv/TRBfL6Sm/949O7iASA1Cyjsi9CxSnIR5EM+DeohVGvXaeapiXtHyZ5Rir6
X9LMtZ/+1m/UUNNiTPry3KrCotE6RzBOUV1f8nowJfCezDIGBHqrueiD2nJSVgva
7eukBbMtbOp2o9jU6V8q4wRrt7bhtkUHF9oS5nv37sCMOSy6/1Ur5poSBZZ+jAoQ
oKXQEsJZlHCyzR1VAaYS8USxMsO4qXgmrGeYAgU2hVdgwEGzp9q8NI+c/JjlHbed
sq5kgcxAtyYeEeBKFpevXS/4dPe4NwNDH5BO0VqSmtPYV8a4IKx6JRcas8tpAXPP
xgJAWRIAl6lGJCqEnORkuqgnVDfSnlGsQRfiG1yvGCPYhwJyd/AfLofAcc6HW44h
TIZD8PXsuevXCBtGWyuC8xnBZEqM2KARjpQZR+Y2K+EU5bZqVYQRT+dcZJJYnT2/
FGcTPr9c6di3Zjo8lAxv7RCkKoKHMxpzFOCBb+BTRO+5cnHmaSP60Um2Lhr5D4/y
p3mhvf1WyZ3Z
=h9nL
-----END PGP SIGNATURE-----