CVE-2021-29429 Information disclosure through temporary directory permissions
Local attackers can read sensitive files downloaded by Gradle due to insecure temporary directory permissions, exposing data to other users on the system.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2021-29429?
CVE-2021-29429 is a medium-severity vulnerability in gradle, published on 12 Apr 2021. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In Gradle before version 7.0, files created with open permissions in the system temporary directory can allow an attacker to access information downloaded by Gradle. Some builds could be vulnerable to a local information disclosure. Remote files accessed through TextResourceFactory are downloaded into the system temporary directory first. Sensitive information contained in these files can be exposed to other local users on the same system. If you do not use the `TextResourceFactory` API, you are not vulnerable. As of Gradle 7.0, uses of the system temporary directory have been moved to the Gradle User Home directory. By default, this directory is restricted to the user running the build. As a workaround, set a more restrictive umask that removes read access to other users. When files are created in the system temporary directory, they will not be accessible to other users. If you are unable to change your system's umask, you can move the Java temporary directory by setting the System Property `java.io.tmpdir`. The new path needs to limit permissions to the build user only.
Weakness: CWE-377
Which versions are affected by CVE-2021-29429?
1 open source package ship an affected version, including gradle. It affects 2 products.
| Package | Affected | Fixed in |
|---|---|---|
gradle Bitnami | All versions | 7.0.0 |
Products include Gradle Gradle, Quarkus Quarkus.
How do I fix CVE-2021-29429?
Upgrade gradle to 7.0.0 or later.
Is CVE-2021-29429 being exploited?
There is no known exploitation of CVE-2021-29429 in the wild and no public exploit code.
Other vulnerabilities in gradle
- CVE-2019-15052 Information disclosure in n/a
- CVE-2016-6199 Deserialization in n/a
- CVE-2021-29428 Local privilege escalation through system temporary directory
- CVE-2026-22816 Gradle fails to disable repositories which can expose builds to malicious artifacts
- CVE-2026-22865 Gradle's failure to disable repositories failing to answer can expose builds to malicious artifacts
Sources
Also known as BIT-gradle-2021-29429, DEBIAN-CVE-2021-29429, GHSA-fp8h-qmr5-j4c8.