CVE-2019-16370

CVE-2019-16370 describes a cryptographic weakness in the PGP signing plugin of Gradle versions prior to 6.0. The vulnerability stems from its reliance on the SHA-1 algorithm for artifact signing, which is susceptible to collision attacks. This allows an unauthenticated attacker to potentially replace a legitimate artifact with a malicious one that shares the same SHA-1 digest, leading to high integrity impact. While the attack complexity is high, there is no evidence of active exploitation, publicly available exploit code, or significant community discussion surrounding this CVE.