CVE-2024-30172: gradle-8
Deferred
AliasesUBUNTU-CVE-2024-30172DEBIAN-CVE-2024-30172CGA-3fjr-cf7h-rmfcCGA-4c8q-pc5q-wfrcCGA-522q-gwmg-7655CGA-8jwc-w73j-v39mCGA-9gph-cxhr-85x3CGA-cfr2-qjmv-8c8vCGA-fvhc-ccrc-832hCGA-g9qp-6r2w-cw8gCGA-gq8j-mg23-xhj5CGA-h8w3-h2vf-5p25CGA-hh3c-754x-g9qgCGA-jm42-mg84-42fqCGA-p5gw-hf7c-fm5jCGA-q3h5-3pfp-3gx2CGA-q8q4-68hf-f5fxCGA-qjx5-9wr2-rrh8CGA-r8vm-j74x-74r8CGA-vh37-9c44-r94hCGA-272p-8qcg-5jj3CGA-285g-29x5-r9w9CGA-2cqp-934r-8fp4CGA-2f73-xf6j-xjmgCGA-2jcx-c925-h3f5CGA-2q9c-qwqw-vf6rCGA-2rjj-8c2j-c3wfCGA-32c7-p9g8-395wCGA-38w9-8435-j8gvCGA-3fgg-w6cq-vcx9CGA-3pfg-p673-6c6gCGA-3rgc-hwfc-g4vrCGA-423q-47hc-wxjgCGA-4938-57gm-7p66CGA-4m9j-r89f-gw4cCGA-4mq6-c4p3-5gf9CGA-4q78-pp89-296wCGA-4wph-427p-2ph9CGA-5cxj-8c5j-6wv3CGA-639w-xfxq-rhpwCGA-6554-7jvf-6mw7CGA-67cc-6h2q-2rxpCGA-6f2f-j5wp-cv83CGA-6gpp-9hh8-wxq2CGA-72mw-7hmc-mv3mCGA-78wg-9rjp-q67qCGA-7cvf-32gm-xg8qCGA-7cx4-wx42-vjm7CGA-7f85-m4fg-7p7vCGA-7q83-4m7w-77chCGA-8fp2-wjf4-fr7fCGA-8h6j-85h3-xhj4CGA-8p4j-222j-cjwgCGA-94f5-xw4p-j35jCGA-96xh-h3fv-8353CGA-9782-m2qw-27xmCGA-98cq-fm98-8853CGA-9g2x-4q8w-7q2gCGA-9mrv-3j9h-hj38CGA-9p53-jjm3-5j62CGA-c62v-m72w-xc48CGA-c932-qrmr-jjcwCGA-c99w-84jw-xhr6CGA-cmf8-pm3f-59c5CGA-cx2c-h7pq-2mfvCGA-cxg3-pr64-2x8vCGA-f59m-8v99-4x76CGA-gf2m-mqq4-p827CGA-gq7v-cgp7-9r73CGA-grh9-xmjr-mh4cCGA-gwf4-xfc4-93gjCGA-h3c4-r686-fp7hCGA-h3v4-h37m-p8f7CGA-h9pf-rrhx-gxhwCGA-hhwv-g6pr-x65jCGA-hmxp-hhpf-j39xCGA-j4c4-3ccg-f24hCGA-jcc7-57v8-vq79CGA-jm9q-jg89-4wf5CGA-jrhh-rq35-8h4mCGA-jxqw-xrff-wc9pCGA-m3f2-6v53-ggm7CGA-m5xw-9hhx-33w2CGA-mjv7-5vjr-88j7CGA-mq6v-9jp2-q97wCGA-mqh6-rgj9-39p9CGA-p56r-3fph-636vCGA-pgqc-5f4q-c79gCGA-phxw-vf7q-mwx6GHSA-m44j-cfrm-g8qcCGA-pwph-4pj7-7c6wCGA-q3q3-rw6w-pc2qCGA-q5jm-7546-m83jCGA-qh5m-p3cq-84w2CGA-jjwj-6v39-vh3fCGA-qhrr-vcmw-hp96CGA-qvj7-v8c8-79g3CGA-qwpm-jrqq-cjrgCGA-rm65-356c-qhq5CGA-rp9w-548g-jxp7CGA-rq46-9qrf-rc47CGA-v33q-wr5w-jr8hCGA-v562-g7rp-hqg8CGA-wc93-3hqr-vwfpCGA-wqjg-88r6-8h37CGA-wqx4-pgv7-gc3wCGA-wv8m-rrcr-6p4hCGA-x3f5-xgg9-pfg2CGA-x5j6-5w92-q5fpCGA-xqx5-4fcp-w98gCGA-xwfj-54h2-2jrf
Published 09-05-2024Last modified 05-11-2024
Vulnerability summary
CVE-2024-30172 is a high (CVSS 7.5) vulnerability in gradle-8. EPSS estimates a 0.75% chance of exploitation in the next 30 days, higher than 55.1% of scored vulnerabilities.
Priority
Prioritisesevere
Severe, CVSS 7.5 (CVE.org); no exploitation reported by the 5 checked sources; EPSS 1% (FIRST, 03-11-2026)
Source freshness unavailable
How is this decided?CVSS score
7.5/10
010
High · v3.1 (CVE.org)EPSS score
0.75%
0%100%
Low · 0.00 pp in 30 daysKEVNot listedNot listed by any tracked catalog.
RansomwareNot flaggedNo ransomware use recorded.
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 6 · Related 18OPENSUSE-SU-2024:13914-1RHSA-2024:5143RHSA-2024:5144RHSA-2024:5145RHSA-2024:5479RHSA-2024:5481CGA-279P-MPW3-F5X7CGA-2W8R-393P-7PWVCGA-3433-JRRM-RH79CGA-35WP-W6C8-232QCGA-449W-QFJV-79C5CGA-7PPG-RJ7H-W9X6CGA-9J68-HCJR-5XFXCGA-FWW5-PPVJ-VHV9CGA-GGC7-MQXG-JCJMCGA-GMQH-QFR2-PH66CGA-GQPV-R8GF-85P6CGA-H5MH-GQ4V-54J6CGA-H94H-F38Q-CHH8CGA-J3FF-HXW3-QP8WCGA-VXWQ-F5F4-5VMJCGA-X3M9-G352-C98XUSN-8108-1
Timeline
- 09-05-2024PublishedVulnerability first disclosed.
- 05-11-2024Last modifiedVulnerability information updated.
Description
An issue was discovered in Bouncy Castle Java Cryptography APIs before 1.78. An Ed25519 verification code infinite loop can occur via a crafted signature and public key.
CVSS metrics
12 scores · 8 sources · 2 versionsMedium 6.9Preferred score · OSV · Wolfi (Ecosystem advisory) · calculated from vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:NSourcesAll 4 agree
- OSV · ChainguardEcosystem advisory · calculated6.9MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
- OSV · MavenEcosystem advisory · calculated6.9MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
- OSV · NugetEcosystem advisory · calculated6.9MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
High 7.5Preferred score · CVE.org (CNA)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HSources8 sources · 5.3–7.5
- OSV · UbuntuEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · DebianEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · WolfiEcosystem advisory · calculated5.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:LDiffers
- OSV · ChainguardEcosystem advisory · calculated5.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:LDiffers
- OSV · MavenEcosystem advisory · calculated5.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:LDiffers
- OSV · NugetEcosystem advisory · calculated5.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:LDiffers
- NVDNIST7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS trend
Probability
0.75%
Chance of exploitation in the next 30 days
Percentile
55%
Versus all other CVEs
30-day change
No change 0.00 pp
From 0.75% on 04-10-2026
04-10-202603-11-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeNo weakness data has been published for this record.
Affected systems
Version check
Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.
Chainguard54 products
- eco-java-gradle-8.8All versions (No fix recorded)
- elasticsearch-7< 7.17.22-r0
- elasticsearch-7-iamguarded< 7.17.22-r0
- gradle-8< 8.7.0-r4
- gradle-stage0< 8.0.1-r0
Wolfi9 products
- gradle-8< 8.7.0-r4
- gradle-stage0< 8.0.1-r0
- jruby-9.4< 9.4.8.0-r0
- jruby-9.4-default-ruby< 9.4.8.0-r0
- keycloak< 25.0.0-r0
Org.bouncycastle6 products
- bcprov-jdk14≥ 1.73, < 1.78
- bcprov-jdk15to18≥ 1.73, < 1.78
- bcprov-jdk18on≥ 1.73, < 1.78
- bctls-jdk14≥ 1.73, < 1.78
- bctls-jdk15to18≥ 1.73, < 1.78
NuGet2 products
- BouncyCastleAll versions (No fix recorded)
- BouncyCastle.Cryptography< 2.3.1
Debian1 product
- bouncycastleAll versions (No fix recorded) | < 1.80-1
Ubuntu1 product
- bouncycastle< 1.77-1ubuntu0.1~esm1
6 vendors · 73 products
