CVE-2023-26053 Gradle usage of long IDs for PGP keys opens potential for collision attacks
Attackers can bypass dependency verification in Gradle by exploiting PGP key ID collisions, allowing malicious dependencies to be trusted.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-26053?
CVE-2023-26053 is a medium-severity vulnerability in gradle, published on 2 Mar 2023. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
Gradle is a build tool with a focus on build automation and support for multi-language development. This is a collision attack on long IDs (64bits) for PGP keys. Users of dependency verification in Gradle are vulnerable if they use long IDs for PGP keys in a `trusted-key` or `pgp` element in their dependency verification metadata file. The fix is to fail dependency verification if anything but a fingerprint is used in a trust element in dependency verification metadata. The problem is fixed in Gradle 8.0 and above. The problem is also patched in Gradle 6.9.4 and 7.6.1. As a workaround, use only full fingerprint IDs for `trusted-key` or `pgp` element in the metadata is a protection against this issue.
Weakness: CWE-829
Which versions are affected by CVE-2023-26053?
1 open source package ship an affected version, including gradle. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
gradle Bitnami | From 6.2.0 | 6.9.4, 7.6.1 |
Products include Gradle Gradle.
How do I fix CVE-2023-26053?
Upgrade gradle to a fixed version for your release line: 6.9.4 or 7.6.1.
Is CVE-2023-26053 being exploited?
There is no known exploitation of CVE-2023-26053 in the wild and no public exploit code.
Other vulnerabilities in gradle
- CVE-2019-15052 Information disclosure in n/a
- CVE-2016-6199 Deserialization in n/a
- CVE-2021-29428 Local privilege escalation through system temporary directory
- CVE-2026-22816 Gradle fails to disable repositories which can expose builds to malicious artifacts
- CVE-2026-22865 Gradle's failure to disable repositories failing to answer can expose builds to malicious artifacts
Sources
Also known as BIT-gradle-2023-26053, CLEANSTART-2026-RH82796, CLEANSTART-2026-UI97459, GHSA-c724-3xg7-g3hf, UBUNTU-CVE-2023-26053.