OS Command Injection in gradle - CVE-2021-32751

Vulnerability identifier: #VU76159

CSH Severity: Low

CVSS v4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2021-32751

CWE-ID: CWE-78

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local user to execute arbitrary shell commands on the target system.

The vulnerability exists due to improper input validation. A local user who can modify environment variables is able to execute arbitrary OS commands when executing the "gradlew build" command or start scripts.

gradle
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise Desktop 15
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Manager Proxy
SUSE Manager Retail Branch Server
SUSE Manager Server
Development Tools Module
openSUSE Leap
gradle

Install updates from vendor's website.

gradle - update to 7.2.0
gradle - update to 4.4.1-150200.3.10.1

• https://github.com/gradle/gradle/security/advisories/GHSA-6j2p-252f-7mw8
• https://mywiki.wooledge.org/BashFAQ/048
• https://medium.com/dot-debug/the-perils-of-bash-eval-cc5f9e309cae

• OS command injection in Gradle
• SUSE update for gradle