Potential information disclosure and remote code execution via TLS bypass due to Java ECDSA cryptographic bypass vulnerability

A critical Java security vulnerability announced on the 19th of March 2022 allows trivial bypass of cryptographic security measures when using the ECDSA encryption algorithm.

Gradle Enterprise server, and all associated components distributed as container images, include a Java runtime of version 11, which is not vulnerable.

The Gradle Enterprise Test Distribution Agent, Gradle Enterprise Build Cache Node, Gradle Enterprise Admin CLI tool and Gradle Enterprise Scans Copy CLI tool are available as both container images and standalone JARs. If you are using any of the standalone JARs, your usage may be vulnerable if you are executing it with a vulnerable Java version.

These components make HTTPS requests to various services. When using a vulnerable Java version, any man-in-the-middle proxy or network infrastructure can intercept these requests nullifying the privacy offered by TLS.

For the Gradle Enterprise Test Distribution Agent and Gradle Enterprise Build Cache Node, an attacker able to intercept such network traffic and reverse engineer the proprietary control protocols used between these components and Gradle Enterprise could obtain build artifacts being transmitted or inject malicious artifacts.

For the Gradle Enterprise Admin CLI tool, an attacker able to intercept such network traffic between the tool and the Kubernetes cluster may observe Kubernetes cluster credentials or observe or interfere with administrative functions, allowing destructive operations on the cluster or Gradle Enterprise.

For the Gradle Enterprise Scans Copy CLI tool, an attacker able to intercept such network traffic could observe authentication credentials that allow access to scan publishing and data export. Furthermore, if able to reverse engineer the proprietary protocol used, the attacker could interfere with scan copying or inject illegitimate scan data.