From b1f8161a20a244d8624fc143a8d56954bfb838d1 Mon Sep 17 00:00:00 2001 From: Jonathan Leitschuh Date: Mon, 3 Oct 2022 23:23:14 +0000 Subject: [PATCH] vuln-fix: Use HTTPS instead of HTTP to resolve dependencies This fixes a security vulnerability in this project where the `build.gradle` files were configuring Gradle to resolve dependencies over HTTP instead of HTTPS. Weakness: CWE-829: Inclusion of Functionality from Untrusted Control Sphere Severity: High CVSSS: 8.1 Detection: OpenRewrite Reported-by: Jonathan Leitschuh Signed-off-by: Jonathan Leitschuh Bug-tracker: https://github.com/JLLeitschuh/security-research/issues/9 Co-authored-by: Moderne --- build.gradle | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/build.gradle b/build.gradle index 7fa356f..2149fa3 100644 --- a/build.gradle +++ b/build.gradle @@ -18,7 +18,7 @@ allprojects { google() jcenter() repositories { - maven { url 'http://oss.sonatype.org/content/repositories/ksoap2-android-releases/'} + maven { url 'https://oss.sonatype.org/content/repositories/ksoap2-android-releases/'} } maven { url "https://jitpack.io" } maven { url "https://artifactory.paytm.in/libs-release-local" } @@ -27,4 +27,4 @@ allprojects { task clean(type: Delete) { delete rootProject.buildDir -} \ No newline at end of file +}