CVE-2020-7599

https://notcve.org/view.php?id=CVE-2020-7599

All versions of com.gradle.plugin-publish before 0.11.0 are vulnerable to Insertion of Sensitive Information into Log File. When a plugin author publishes a Gradle plugin while running Gradle with the --info log level flag, the Gradle Logger logs an AWS pre-signed URL. If this build log is publicly visible (as it is in many popular public CI systems like TravisCI) this AWS pre-signed URL would allow a malicious actor to replace a recently uploaded plugin with their own. Todas las versiones de com.gradle.plugin-publishing anteriores a 0.11.0, son vulnerables a la Inserción de Información Confidencial en el Archivo de Registro (Log File). Cuando un autor del plugin publica un plugin de Gradle mientras ejecuta Gradle con el flag de nivel de registro --info, Gradle Logger registra una URL pre-firmada de AWS. • https://blog.gradle.org/plugin-portal-update https://snyk.io/vuln/SNYK-JAVA-COMGRADLEPLUGINPUBLISH-559866 • CWE-532: Insertion of Sensitive Information into Log File •