Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2022-31138 State: PUBLISHED Published: 2022-07-11T14:00:15.000Z Last Updated: 2025-04-22T17:49:53.318Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: mailcow Products: mailcow-dockerized Problem Types: CWE-78 Description: mailcow is a mailserver suite. Prior to mailcow-dockerized version 2022-06a, an extended privilege vulnerability can be exploited by manipulating the custom parameters regexmess, skipmess, regexflag, delete2foldersonly, delete2foldersbutnot, regextrans2, pipemess, or maxlinelengthcmd to execute arbitrary code. Users should update their mailcow instances with the `update.sh` script in the mailcow root directory to 2022-06a or newe
sers should update their mailcow instances with the `update.sh` script in the mailcow root directory to 2022-06a or newer to receive a patch for this issue. As a temporary workaround, the Syncjob ACL can be removed from all mailbox users, preventing changes to those settings. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/mailcow/mailcow-dockerized/security/advisories/GHSA-vx9w-h33p-5vhc - https://github.com/mailcow/mailcow-dockerized/commit/d373164e13a14e058f82c9f1918a5612f375a9f9 - https://github.com/ly1g3/Mailcow-CVE-2022-31138 - https://github.com/mailcow/mailcow-dockerized/releases/tag/2022-06a
CVE ID: CVE-2022-31139 State: PUBLISHED Published: 2022-07-11T18:25:11.000Z Last Updated: 2025-04-23T18:03:51.382Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: Karlatemp Products: UnsafeAccessor Problem Types: CWE-200 Description: UnsafeAccessor (UA) is a bridge to access jdk.internal.misc.Unsafe & sun.misc.Unsafe. Normally, if UA is loaded as a named module, the internal data of UA is protected by JVM and others can only access UA via UA's standard API. The main application can set up `SecurityCheck.AccessLimiter` for UA to limit access to UA. Starting with version 1.4.0 and prior to version 1.7.0, when `SecurityCheck.AccessLimiter` is set up, untrusted
to UA. Starting with version 1.4.0 and prior to version 1.7.0, when `SecurityCheck.AccessLimiter` is set up, untrusted code can access UA without limitation, even when UA is loaded as a named module. This issue does not affect those for whom `SecurityCheck.AccessLimiter` is not set up. Version 1.7.0 contains a patch. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/Karlatemp/UnsafeAccessor/security/advisories/GHSA-cr6p-23cf-w9g9 - https://github.com/Karlatemp/UnsafeAccessor/commit/4ef83000184e8f13239a1ea2847ee401d81585fd - https://github.com/Karlatemp/UnsafeAccessor/releases/tag/1.7.0
CVE ID: CVE-2022-31140 State: PUBLISHED Published: 2022-07-11T19:55:09.000Z Last Updated: 2025-04-22T17:49:30.998Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: CuyZ Products: Valinor Problem Types: CWE-209 Description: Valinor is a PHP library that helps to map any input into a strongly-typed value object structure. Prior to version 0.12.0, Valinor can use `Throwable#getMessage()` when it should not have permission to do so. This is a problem with cases such as an SQL exception showing an SQL snippet, a database connection exception showing database IP address/username/password, or a timeout detail / out of memory detail. Attackers could use this informatio
g database IP address/username/password, or a timeout detail / out of memory detail. Attackers could use this information for potential data exfiltration, denial of service attacks, enumeration attacks, etc. Version 0.12.0 contains a patch for this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/CuyZ/Valinor/security/advisories/GHSA-5pgm-3j3g-2rc7 - https://github.com/CuyZ/Valinor/releases/tag/0.12.0
CVE ID: CVE-2022-31142 State: PUBLISHED Published: 2022-07-14T18:55:11.000Z Last Updated: 2025-04-23T18:02:16.307Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: fastify Products: fastify-bearer-auth Problem Types: CWE-208 Description: @fastify/bearer-auth is a Fastify plugin to require bearer Authorization headers. @fastify/bearer-auth prior to versions 7.0.2 and 8.0.1 does not securely use crypto.timingSafeEqual. A malicious attacker could estimate the length of one valid bearer token. According to the corresponding RFC 6750, the bearer token has only base64 valid characters, reducing the range of characters for a brute force attack. Version 7.0.2 and 8.0.1
ken has only base64 valid characters, reducing the range of characters for a brute force attack. Version 7.0.2 and 8.0.1 of @fastify/bearer-auth contain a patch. There are currently no known workarounds. The package fastify-bearer-auth, which covers versions 6.0.3 and prior, is also vulnerable starting at version 5.0.1. Users of fastify-bearer-auth should upgrade to a patched version of @fastify/bearer-auth. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/fastify/fastify-bearer-auth/security/advisories/GHSA-376v-xgjx-7mfr - https://github.com/fastify/fastify-bearer-auth/commit/0c468a616d7e56126dc468150f6a5a92e530b8e4 - https://gith
gjx-7mfr - https://github.com/fastify/fastify-bearer-auth/commit/0c468a616d7e56126dc468150f6a5a92e530b8e4 - https://github.com/fastify/fastify-bearer-auth/commit/39353b15409ee99474545f615ffb16180cf3b716 - https://github.com/fastify/fastify-bearer-auth/commit/f921a0582dc83112039004a9b5041141b50c5b3f - https://hackerone.com/reports/1633287
CVE ID: CVE-2022-31143 State: PUBLISHED Published: 2022-09-14T17:40:09.000Z Last Updated: 2025-04-23T17:10:45.574Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: glpi-project Products: glpi Problem Types: CWE-200 Description: GLPI stands for Gestionnaire Libre de Parc Informatique and is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. It was found that in affected versions there is an exposure of private information defined in setup of GLPI (like smtp or cas hosts). Note that passwords are not exposed. Users are advised to upgrade to version 10.0.3. There are no known workar
s hosts). Note that passwords are not exposed. Users are advised to upgrade to version 10.0.3. There are no known workarounds for this issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/glpi-project/glpi/security/advisories/GHSA-6mmq-x3j2-677j - https://github.com/glpi-project/glpi/commit/e66a0dfe697cbd4b3ec22736a8f8fd025a28f978
CVE ID: CVE-2022-31144 State: PUBLISHED Published: 2022-07-19T20:15:13.000Z Last Updated: 2025-04-23T17:58:05.076Z Severity: HIGH (CVSS 7 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: redis Products: redis Problem Types: CWE-122 Description: Redis is an in-memory database that persists on disk. A specially crafted `XAUTOCLAIM` command on a stream key in a specific state may result with heap overflow, and potentially remote code execution. This problem affects versions on the 7.x branch prior to 7.0.4. The patch is released in version 7.0.4. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/redis/redis/security/advisories/GHS
: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/redis/redis/security/advisories/GHSA-96f7-42fg-2jrh - https://github.com/redis/redis/releases/tag/7.0.4 - https://security.netapp.com/advisory/ntap-20220909-0002/ - https://security.gentoo.org/glsa/202209-17
CVE ID: CVE-2022-31145 State: PUBLISHED Published: 2022-07-13T20:30:12.000Z Last Updated: 2025-04-23T18:02:22.237Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N) Vendors: flyteorg Products: flyteadmin Problem Types: CWE-613 Description: FlyteAdmin is the control plane for Flyte responsible for managing entities and administering workflow executions. In versions 1.1.30 and prior, authenticated users using an external identity provider can continue to use Access Tokens and ID Tokens even after they expire. Users who use FlyteAdmin as the OAuth2 Authorization Server are unaffected by this issue. A patch is available on the `master` branch of the repository. As a workar
rization Server are unaffected by this issue. A patch is available on the `master` branch of the repository. As a workaround, rotating signing keys immediately will invalidate all open sessions and force all users to attempt to obtain new tokens. Those who use this workaround should continue to rotate keys until FlyteAdmin has been upgraded and hide FlyteAdmin deployment ingress URL from the internet. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/flyteorg/flyteadmin/security/advisories/GHSA-qwrj-9hmp-gpxh - https://github.com/flyteorg/flyteadmin/pull/455 - https://github.com/flyteorg/flyteadmin/commit/a1ec282d02706e074bc4986fd041
s://github.com/flyteorg/flyteadmin/pull/455 - https://github.com/flyteorg/flyteadmin/commit/a1ec282d02706e074bc4986fd0412e5da3b9d00a
CVE ID: CVE-2022-31146 State: PUBLISHED Published: 2022-07-20T22:30:16.000Z Last Updated: 2025-04-23T17:57:59.088Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:L) Vendors: bytecodealliance Products: wasmtime Problem Types: CWE-416 Description: Wasmtime is a standalone runtime for WebAssembly. There is a bug in the Wasmtime's code generator, Cranelift, where functions using reference types may be incorrectly missing metadata required for runtime garbage collection. This means that if a GC happens at runtime then the GC pass will mistakenly think these functions do not have live references to GC'd values, reclaiming them and deallocating them. The function will then su
e functions do not have live references to GC'd values, reclaiming them and deallocating them. The function will then subsequently continue to use the values assuming they had not been GC'd, leading later to a use-after-free. This bug was introduced in the migration to the `regalloc2` register allocator that occurred in the Wasmtime 0.37.0 release on 2022-05-20. This bug has been patched and users should upgrade to Wasmtime version 0.38.2. Mitigations for this issue can be achieved by disabling the reference types proposal by passing `false` to `wasmtime::Config::wasm_reference_types` or downgrading to Wasmtime 0.36.0 or prior. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vu
ence_types` or downgrading to Wasmtime 0.36.0 or prior. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-5fhj-g3p3-pq9g - https://github.com/WebAssembly/reference-types - https://github.com/bytecodealliance/wasmtime/
CVE ID: CVE-2022-31147 State: PUBLISHED Published: 2022-07-14T19:30:14.000Z Last Updated: 2025-04-23T18:02:09.780Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: jquery-validation Products: jquery-validation Problem Types: CWE-1333 Description: The jQuery Validation Plugin (jquery-validation) provides drop-in validation for forms. Versions of jquery-validation prior to 1.19.5 are vulnerable to regular expression denial of service (ReDoS) when an attacker is able to supply arbitrary input to the url2 method. This is due to an incomplete fix for CVE-2021-43306. Users should upgrade to version 1.19.5 to receive a patch. Additional Analyst Notes: - CVE Program Co
or CVE-2021-43306. Users should upgrade to version 1.19.5 to receive a patch. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/jquery-validation/jquery-validation/security/advisories/GHSA-ffmh-x56j-9rc3 - https://github.com/jquery-validation/jquery-validation/commit/5bbd80d27fc6b607d2f7f106c89522051a9fb0dd - https://github.com/jquery-validation/jquery-validation/releases/tag/1.19.5
CVE ID: CVE-2022-31148 State: PUBLISHED Published: 2022-08-01T17:10:12.000Z Last Updated: 2025-04-23T17:56:53.899Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: shopware Products: shopware Problem Types: CWE-79 Description: Shopware is an open source e-commerce software. In versions from 5.7.0 a persistent cross site scripting (XSS) vulnerability exists in the customer module. Users are recommend to update to the current version 5.7.14. You can get the update to 5.7.14 regularly via the Auto-Updater or directly via the download overview. There are no known workarounds for this issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichmen
There are no known workarounds for this issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/shopware/shopware/security/advisories/GHSA-5834-xv5q-cgfw - https://github.com/shopware/shopware/commit/7875855005648fba7b39371a70816afae2e07daf - https://docs.shopware.com/en/shopware-5-en/security-updates/security-update-07-2022
CVE ID: CVE-2022-31149 State: PUBLISHED Published: 2022-09-07T13:50:12.000Z Last Updated: 2025-04-22T17:24:00.542Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: ActivityWatch Products: activitywatch Problem Types: CWE-290 Description: ActivityWatch open-source automated time tracker. Versions prior to 0.12.0b2 are vulnerable to DNS rebinding attacks. This vulnerability impacts everyone running ActivityWatch and gives the attacker full access to the ActivityWatch REST API. Users should upgrade to v0.12.0b2 or later to receive a patch. As a workaround, block DNS lookups that resolve to 127.0.0.1. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vu
orkaround, block DNS lookups that resolve to 127.0.0.1. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/ActivityWatch/activitywatch/security/advisories/GHSA-v9fg-6g9j-h4x4 - https://gist.github.com/zozs/fdebbce75fc8538c15851b46db944a16 - https://github.com/ActivityWatch/activitywatch/discussions/778
CVE ID: CVE-2022-31150 State: PUBLISHED Published: 2022-07-19T20:40:10.000Z Last Updated: 2025-04-22T17:48:45.328Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: nodejs Products: undici Problem Types: CWE-93 Description: undici is an HTTP/1.1 client, written from scratch for Node.js. It is possible to inject CRLF sequences into request headers in undici in versions less than 5.7.1. A fix was released in version 5.8.0. Sanitizing all HTTP headers from untrusted sources to eliminate `\r\n` is a workaround for this issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/nodejs/undici/security/advisori
otes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/nodejs/undici/security/advisories/GHSA-3cvr-822r-rqcc - https://hackerone.com/reports/409943 - https://github.com/nodejs/undici/releases/tag/v5.8.0 - https://security.netapp.com/advisory/ntap-20220915-0002/
CVE ID: CVE-2022-31151 State: PUBLISHED Published: 2022-07-20T23:00:15.000Z Last Updated: 2025-04-22T17:48:20.472Z Severity: LOW (CVSS 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: nodejs Products: undici Problem Types: CWE-601 Description: Authorization headers are cleared on cross-origin redirect. However, cookie headers which are sensitive headers and are official headers found in the spec, remain uncleared. There are active users using cookie headers in undici. This may lead to accidental leakage of cookie to a 3rd-party site or a malicious attacker who can control the redirection target (ie. an open redirector) to leak the cookie to the 3rd party site. This was patched in v
control the redirection target (ie. an open redirector) to leak the cookie to the 3rd party site. This was patched in v5.7.1. By default, this vulnerability is not exploitable. Do not enable redirections, i.e. `maxRedirections: 0` (the default). Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/nodejs/undici/security/advisories/GHSA-q768-x9m6-m9qp - https://github.com/nodejs/undici/issues/872 - https://hackerone.com/reports/1635514 - https://security.netapp.com/advisory/ntap-20220909-0006/
CVE ID: CVE-2022-31152 State: PUBLISHED Published: 2022-09-02T20:00:16.000Z Last Updated: 2025-04-23T17:32:15.848Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:H) Vendors: matrix-org Products: synapse Problem Types: CWE-703 Description: Synapse is an open-source Matrix homeserver written and maintained by the Matrix.org Foundation. The Matrix specification specifies a list of [event authorization rules](https://spec.matrix.org/v1.2/rooms/v9/#authorization-rules) which must be checked when determining if an event should be accepted into a room. In versions of Synapse up to and including version 1.61.0, some of these rules are not correctly applied. An attacker could c
rsions of Synapse up to and including version 1.61.0, some of these rules are not correctly applied. An attacker could craft events which would be accepted by Synapse but not a spec-conformant server, potentially causing divergence in the room state between servers. Administrators of homeservers with federation enabled are advised to upgrade to version 1.62.0 or higher. Federation can be disabled by setting [`federation_domain_whitelist`](https://matrix-org.github.io/synapse/latest/usage/configuration/config_documentation.html#federation_domain_whitelist) to an empty list (`[]`) as a workaround. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https:/
`[]`) as a workaround. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/matrix-org/synapse/security/advisories/GHSA-jhjh-776m-4765 - https://github.com/matrix-org/synapse/pull/13087 - https://github.com/matrix-org/synapse/pull/13088 - https://github.com/matrix-org/synapse/releases/tag/v1.62.0
CVE ID: CVE-2022-31153 State: PUBLISHED Published: 2022-07-15T17:50:14.000Z Last Updated: 2025-04-22T17:48:58.458Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: OpenZeppelin Products: cairo-contracts Problem Types: CWE-664 Description: OpenZeppelin Contracts for Cairo is a library for contract development written in Cairo for StarkNet, a decentralized ZK Rollup. Version 0.2.0 is vulnerable to an error that renders account contracts unusable on live networks. This issue affects all accounts (vanilla and ethereum flavors) in the v0.2.0 release of OpenZeppelin Contracts for Cairo, which are not whitelisted on StarkNet mainnet. Only goerli deployments of v0.2.
ase of OpenZeppelin Contracts for Cairo, which are not whitelisted on StarkNet mainnet. Only goerli deployments of v0.2.0 accounts are affected. This faulty behavior is not observed in StarkNet's testing framework. This bug has been patched in v0.2.1. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/OpenZeppelin/cairo-contracts/security/advisories/GHSA-8mjr-jr5h-q2xr - https://github.com/OpenZeppelin/cairo-contracts/issues/386 - https://github.com/OpenZeppelin/cairo-contracts/pull/387 - https://github.com/OpenZeppelin/cairo-contracts/commit/2cd60279c3332285d47edf9ee3888b71257acdc9 - https://github.com/OpenZeppelin/cairo-contracts/bl
lin/cairo-contracts/commit/2cd60279c3332285d47edf9ee3888b71257acdc9 - https://github.com/OpenZeppelin/cairo-contracts/blob/release-0.2.0/src/openzeppelin/account/library.cairo#L203 - https://github.com/OpenZeppelin/cairo-contracts/releases/tag/v0.2.1
CVE ID: CVE-2022-31154 State: PUBLISHED Published: 2022-08-01T18:40:10.000Z Last Updated: 2025-04-23T17:56:47.681Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:L) Vendors: sourcegraph Products: sourcegraph Problem Types: CWE-863 Description: Sourcegraph is an opensource code search and navigation engine. It is possible for an authenticated Sourcegraph user to edit the Code Monitors owned by any other Sourcegraph user. This includes being able to edit both the trigger and the action of the monitor in question. An attacker is not able to read contents of existing code monitors, only override the data. The issue is fixed in Sourcegraph 3.42. There are no workaround for
of existing code monitors, only override the data. The issue is fixed in Sourcegraph 3.42. There are no workaround for the issue and patching is highly recommended. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/sourcegraph/sourcegraph/security/advisories/GHSA-5866-hhq9-9hpc - https://github.com/sourcegraph/sourcegraph/pull/37526
CVE ID: CVE-2022-31155 State: PUBLISHED Published: 2022-08-01T18:40:28.000Z Last Updated: 2025-04-23T17:56:41.203Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: sourcegraph Products: sourcegraph Problem Types: CWE-863 Description: Sourcegraph is an opensource code search and navigation engine. In Sourcegraph versions before 3.41.0, it is possible for an attacker to delete other users’ saved searches due to a bug in the authorization check. The vulnerability does not allow the reading of other users’ saved searches, only overwriting them with attacker-controlled searches. The issue is patched in Sourcegraph version 3.41.0. There is no workaround for this is
ith attacker-controlled searches. The issue is patched in Sourcegraph version 3.41.0. There is no workaround for this issue and updating to a secure version is highly recommended. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/sourcegraph/sourcegraph/security/advisories/GHSA-37qp-9jq6-f6mx - https://github.com/sourcegraph/sourcegraph/commit/2832d7882396a6295ba5803b5ef48dc7d5a24c59
CVE ID: CVE-2022-31156 State: PUBLISHED Published: 2022-07-14T20:05:11.000Z Last Updated: 2025-04-23T18:02:03.963Z Severity: MEDIUM (CVSS 6.6 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: gradle Products: gradle Problem Types: CWE-829 Description: Gradle is a build tool. Dependency verification is a security feature in Gradle Build Tool that was introduced to allow validation of external dependencies either through their checksum or cryptographic signatures. In versions 6.2 through 7.4.2, there are some cases in which Gradle may skip that verification and accept a dependency that would otherwise fail the build as an untrusted external artifact. This can occur in two ways. When signa
dependency that would otherwise fail the build as an untrusted external artifact. This can occur in two ways. When signature verification is disabled but the verification metadata contains entries for dependencies that only have a `gpg` element but no `checksum` element. When signature verification is enabled, the verification metadata contains entries for dependencies with a `gpg` element but there is no signature file on the remote repository. In both cases, the verification will accept the dependency, skipping signature verification and not complaining that the dependency has no checksum entry. For builds that are vulnerable, there are two risks. Gradle could download a malicious binary f
y has no checksum entry. For builds that are vulnerable, there are two risks. Gradle could download a malicious binary from a repository outside your organization due to name squatting. For those still using HTTP only and not HTTPS for downloading dependencies, the build could download a malicious library instead of the expected one. Gradle 7.5 patches this issue by making sure to run checksum verification if signature verification cannot be completed, whatever the reason. Two workarounds are available: Remove all `gpg` elements from dependency verification metadata if you disable signature validation and/or avoid adding `gpg` entries for dependencies that do not have signature files. Additi