docs commit: CB-12403: added android release blog post

[st...@apache.org]

Repository: cordova-docs
Updated Branches:
  refs/heads/master 1047d52b3 -> 8e2f3dd52


CB-12403: added android release blog post


Project: http://git-wip-us.apache.org/repos/asf/cordova-docs/repo
Commit: http://git-wip-us.apache.org/repos/asf/cordova-docs/commit/8e2f3dd5
Tree: http://git-wip-us.apache.org/repos/asf/cordova-docs/tree/8e2f3dd5
Diff: http://git-wip-us.apache.org/repos/asf/cordova-docs/diff/8e2f3dd5

Branch: refs/heads/master
Commit: 8e2f3dd529364dc469f0acf17c551302b6e203ef
Parents: 1047d52
Author: Steve Gill <st...@gmail.com>
Authored: Fri Jan 27 11:29:53 2017 -0800
Committer: Steve Gill <st...@gmail.com>
Committed: Fri Jan 27 11:29:53 2017 -0800

----------------------------------------------------------------------
 www/_posts/2017-01-27-android-612.md | 46 +++++++++++++++++++++++++++++++
 1 file changed, 46 insertions(+)
----------------------------------------------------------------------


http://git-wip-us.apache.org/repos/asf/cordova-docs/blob/8e2f3dd5/www/_posts/2017-01-27-android-612.md
----------------------------------------------------------------------
diff --git a/www/_posts/2017-01-27-android-612.md b/www/_posts/2017-01-27-android-612.md
new file mode 100644
index 0000000..9fec65f
--- /dev/null
+++ b/www/_posts/2017-01-27-android-612.md
@@ -0,0 +1,46 @@
+---
+layout: post
+author:
+    name: Steve Gill
+    url: https://twitter.com/stevesgill
+title:  "Apache Cordova Android 6.1.2 Released"
+categories: announcements
+tags: news releases security
+---
+
+A Security issue was discovered in`cordova-android`. We are releasing `cordova-android@6.1.2` to address this security issue. We recommend that all **Android** applications built using `cordova-android` be upgraded to use version `6.1.2`. Other Cordova platforms such as **iOS** are unaffected, and do not have an update.
+
+When using the Cordova CLI, update with the following command:
+
+    cordova platform update android@6.1.2
+
+The security issue is `CVE-2017-3160`
+
+For your convenience, the text of this CVE is included here.
+
+<!--more-->
+
+____
+
+CVE-2017-3160: Gradle Distribution URL used by Cordova-Android does not use https by default
+
+Severity: 
+High
+
+Vendor: 
+The Apache Software Foundation
+
+Versions Affected:
+Cordova Android (6.1.1 and below)
+
+Description:
+After the Android platform is added to Cordova the first time, or after a project is created using the build scripts, the scripts will fetch Gradle on the first build.  However, since the default URI is not using https, it is vulnerable to a MiTM and the Gradle executable is not safe.  The severity of this issue is high due to the fact that the build scripts immediately start a build after Gradle has been fetched.
+
+Upgrade path:
+Developers who are concerned about this issue should install version 6.1.2 or higher of Cordova-Android.
+
+Mitigation Steps:
+If developers are unable to install the latest version, this vulnerability can easily be mitigated by setting the CORDOVA_ANDROID_GRADLE_DISTRIBUTION_URL environment variable to https://services.gradle.org/distributions/gradle-2.14.1-all.zip
+
+Credit:
+Alon Galili


---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@cordova.apache.org
For additional commands, e-mail: commits-help@cordova.apache.org