CVE catalog

CVE-2022-23630

gradle affected and fixed versions

Gradle is a build tool with a focus on build automation and support for multi-language development. In some cases, Gradle may skip that verification and accept a dependency that would otherwise fail the build as an untrusted external artifact. This occurs when dependency verification is disabled on one or more configurations and those configurations have common dependencies with other configurations that have dependency verification enabled. If the configuration that has dependency verification disabled is resolved first, Gradle does not verify the common dependencies for the configuration that has dependency verification enabled. Gradle 7.4 fixes that issue by validating artifacts at least once if they are present in a resolved configuration that has dependency verification active. For users who cannot update either do not use `ResolutionStrategy.disableDependencyVerification()` and do not use plugins that use that method to disable dependency verification for a single configuration or make sure resolution of configuration that disable that feature do not happen in builds that resolve configuration where the feature is enabled.

Severity: Medium · CVSS 6.6CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
Published: Feb 10, 2022, 12:00:00 AM UTC
Source: [NVD] · [CVE record]
EPSS: 1.32% · Oct 27, 2026

Projects and upstream resources

[gradle][Source-reported homepage]

Reported versions and fixes

Each observation applies to its named package, distribution, and release. Distribution backports can fix a vulnerability while retaining an older upstream version number.

Distribution / release	Package	Version	Status	Source
Debiantrixie	gradle	Not reported	Not affectedDistribution reports not affected	[CVE-2022-23630]
Debiantrixie	gradle	`4.4.1-22`	Not affected	[CVE-2022-23630]
Debiansid	gradle	Not reported	Not affectedDistribution reports not affected	[CVE-2022-23630]
Debiansid	gradle	`4.8-1`	Not affected	[CVE-2022-23630]
Debianforky	gradle	Not reported	Not affectedDistribution reports not affected	[CVE-2022-23630]
Debianforky	gradle	`4.7-1`	Not affected	[CVE-2022-23630]
Debianbookworm	gradle	Not reported	Not affectedDistribution reports not affected	[CVE-2022-23630]
Debianbookworm	gradle	`4.4.1-18`	Not affected	[CVE-2022-23630]

Provider details and historical evidence

Distribution / release	Package	Version	Status	Source
Debianbookworm	gradle	Not reported	Not affectedDistribution reports not affected	[CVE-2022-23630]
Debianbookworm	gradle	`4.4.1-18`	Not affected	[CVE-2022-23630]
Debianforky	gradle	Not reported	Not affectedDistribution reports not affected	[CVE-2022-23630]
Debianforky	gradle	`4.7-1`	Not affected	[CVE-2022-23630]
Debiansid	gradle	Not reported	Not affectedDistribution reports not affected	[CVE-2022-23630]
Debiansid	gradle	`4.8-1`	Not affected	[CVE-2022-23630]
Debiantrixie	gradle	Not reported	Not affectedDistribution reports not affected	[CVE-2022-23630]
Debiantrixie	gradle	`4.4.1-22`	Not affected	[CVE-2022-23630]

Original provider fields

{
  "package_releases": [
    {
      "name": "gradle",
      "status": "not affected",
      "release": "sid",
      "version": "4.8-1"
    },
    {
      "name": "gradle",
      "status": "not affected",
      "release": "forky",
      "version": "4.7-1"
    },
    {
      "name": "gradle",
      "status": "not affected",
      "release": "trixie",
      "version": "4.4.1-22"
    },
    {
      "name": "gradle",
      "status": "not affected",
      "release": "bookworm",
      "version": "4.4.1-18"
    }
  ],
  "fixed_versions": [
    {
      "bug": null,
      "name": "gradle",
      "type": "source",
      "origin": null,
      "release": "sid",
      "urgency": "unimportant",
      "fixed_version": "0"
    },
    {
      "bug": null,
      "name": "gradle",
      "type": "source",
      "origin": null,
      "release": "forky",
      "urgency": "unimportant",
      "fixed_version": "0"
    },
    {
      "bug": null,
      "name": "gradle",
      "type": "source",
      "origin": null,
      "release": "trixie",
      "urgency": "unimportant",
      "fixed_version": "0"
    },
    {
      "bug": null,
      "name": "gradle",
      "type": "source",
      "origin": null,
      "release": "bookworm",
      "urgency": "unimportant",
      "fixed_version": "0"
    }
  ],
  "distribution_packages": []
}

OpenFactory catalog packages

Matching against OpenFactory catalog package versions is in progress.

[Debian 12 (Bookworm)]

[gradle]Unknown
Details (2)
- 4.4.1-18 · all · bookworm
  Not affected
  dsa · gradle · debian · bookworm
- 4.4.1-18 · all · bookworm
  Not affected
  dsa · gradle · debian · bookworm
[gradle-doc]Unknown
Source package: [gradle]
Details (2)
- 4.4.1-18 · all · bookworm
  Not affected
  dsa · gradle · debian · bookworm
- 4.4.1-18 · all · bookworm
  Not affected
  dsa · gradle · debian · bookworm
[libgradle-core-java]Unknown
Source package: [gradle]
Details (2)
- 4.4.1-18 · all · bookworm
  Not affected
  dsa · gradle · debian · bookworm
- 4.4.1-18 · all · bookworm
  Not affected
  dsa · gradle · debian · bookworm
[libgradle-plugins-java]Unknown
Source package: [gradle]
Details (2)
- 4.4.1-18 · all · bookworm
  Not affected
  dsa · gradle · debian · bookworm
- 4.4.1-18 · all · bookworm
  Not affected
  dsa · gradle · debian · bookworm

Observed: Oct 23, 2026, 6:24:41 PM UTC

References

[Debian Security Tracker] · [FIRST EPSS] · [Red Hat security advisories and VEX]