CVE-2021-29427: 
Gradle vulnerability analysis and mitigation

In Gradle versions from 5.1 to 6.8.3, there exists a vulnerability (CVE-2021-29427) related to repository content filtering, a security control feature. The vulnerability was discovered and disclosed in April 2021, affecting the Gradle build automation tool. The issue specifically occurs when repository content filtering is used within a pluginManagement block in settings files, potentially compromising the intended security controls (GitHub Advisory).

The vulnerability stems from Gradle ignoring content filters and searching all repositories for dependencies when repository content filtering is used within a pluginManagement block in settings files. This behavior affects how dependencies are resolved for Gradle plugins and build scripts. The issue has been assigned a CVSS v3.1 base score of 8.0 (HIGH) with the vector string CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H, indicating a network-based attack vector with high complexity and required privileges (GitHub Advisory).

The vulnerability presents two primary risks: 1) Information disclosure, where Gradle could make dependency requests to repositories outside an organization and leak internal package identifiers, and 2) Dependency poisoning/Dependency confusion, where Gradle could download malicious binaries from repositories outside the organization due to name squatting (GitHub Advisory).

The vulnerability has been patched in Gradle 7.0, and users relying on this feature are recommended to upgrade as soon as possible. For those unable to upgrade immediately, two workarounds are available: 1) Use a company repository with appropriate rules for fetching packages from public repositories, or 2) Use project level repository content filtering inside buildscript.repositories, which has been available since Gradle 5.1 (GitHub Advisory, Release Notes).

The vulnerability was responsibly disclosed by Zac Sweers from Slack, highlighting the security community's active role in identifying and reporting security issues in build tools. The issue was introduced in response to the "A Confusing Dependency" blog post, which initially prompted the implementation of repository content filtering as a security control (GitHub Advisory).