CVE-2020-7599: 
Java vulnerability analysis and mitigation

All versions of com.gradle.plugin-publish before 0.11.0 are vulnerable to Insertion of Sensitive Information into Log File (CVE-2020-7599). The vulnerability was discovered on March 4, 2020, by Danny Thomas from Netflix and was publicly disclosed on March 27, 2020. When a plugin author publishes a Gradle plugin using this package while running Gradle with elevated log levels (--info or --debug), sensitive pre-signed AWS URLs are exposed in the log files (Gradle Blog, Snyk Blog).

The vulnerability occurs when the plugin receives a pre-signed AWS S3 URL for uploading artifacts to the Plugin Portal. This URL, valid for one hour, is logged at the info or debug log level. While the default log level (LIFECYCLE) does not expose this information, running builds with elevated logging levels (--info or --debug) captures these sensitive URLs in build logs (Gradle Blog).

If build logs are publicly visible, as is common in many public CI systems, attackers could use the exposed pre-signed URLs to replace recently uploaded plugins with malicious versions within the one-hour validity window. This could potentially enable large-scale supply chain attacks through compromised plugins (Snyk Blog).

The issue has been patched in version 0.11.0 of the com.gradle.plugin-publish plugin, which reduces the log level of the pre-signed URL. Users are strongly advised to upgrade to this version, as previous versions no longer work with the Plugin Portal. Additionally, it is recommended to avoid running builds handling sensitive information with elevated log levels and to keep build logs private (Gradle Blog).

In response to the vulnerability, Gradle conducted a thorough investigation of all artifacts (over 190,000) in the Plugin Portal. They also worked with major cloud CI providers, including GitHub and CircleCI IR Teams, to identify potentially exposed pre-signed URLs in build logs. The vulnerability prompted Gradle to implement changes to detect overwritten artifacts and enhance security around the Gradle plugin ecosystem (Gradle Blog).