CVE-2021-29428

Range taken from the CVE record, check it before committing. make newentry in security/vuxml creates the vid.

  <vuln vid="FIXME (make newentry)">
    <topic>FIXME -- FIXME</topic>
    <affects>
      <package>
	<name>gradle5</name>
	<range><lt>7.0</lt></range>
      </package>
      <package>
	<name>gradle62</name>
	<range><lt>7.0</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>In Gradle before version 7.0, on Unix-like systems, the system
	temporary directory can be created with open permissions that allow
	multiple users to create and delete files within it. Gradle builds
	could be vulnerable to a local privilege escalation from an attacker
	quickly deleting and recreating files in the system temporary
	directory. This vulnerability impacted builds using precompiled script
	plugins written in Kotlin DSL and tests for Gradle plugins written
	using ProjectBuilder or TestKit. If you are on Windows or modern
	versions of macOS, you are not vulnerable. If you are on a Unix-like
	operating system with the "sticky" bit set on your system temporary
	directory, you are not vulnerable. The problem has been patched and
	released with Gradle 7.0. As a workaround, on Unix-like operating
	systems, ensure that the "sticky" bit is set. This only allows the
	original user (or root) to delete a file. If you are unable to change
	the permissions of the system temporary directory, you can move the
	Java temporary directory by setting the System Property
	`java.io.tmpdir`. The new path needs to limit permissions to the build
	user only. For additional details refer to the referenced GitHub
	Security Advisory.</p>
      </body>
    </description>
    <references>
      <cvename>CVE-2021-29428</cvename>
      <url>https://nvd.nist.gov/vuln/detail/CVE-2021-29428</url>
    </references>
    <dates>
      <discovery>2021-04-13</discovery>
      <entry>2026-10-25</entry>
    </dates>
  </vuln>