CVE-2022-23630

Range taken from the CVE record, check it before committing. make newentry in security/vuxml creates the vid.

  <vuln vid="FIXME (make newentry)">
    <topic>FIXME -- FIXME</topic>
    <affects>
      <package>
	<name>gradle62</name>
	<range><lt>FIXME</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Gradle is a build tool with a focus on build automation and support
	for multi-language development. In some cases, Gradle may skip that
	verification and accept a dependency that would otherwise fail the
	build as an untrusted external artifact. This occurs when dependency
	verification is disabled on one or more configurations and those
	configurations have common dependencies with other configurations that
	have dependency verification enabled. If the configuration that has
	dependency verification disabled is resolved first, Gradle does not
	verify the common dependencies for the configuration that has
	dependency verification enabled. Gradle 7.4 fixes that issue by
	validating artifacts at least once if they are present in a resolved
	configuration that has dependency verification active. For users who
	cannot update either do not use
	`ResolutionStrategy.disableDependencyVerification()` and do not use
	plugins that use that method to disable dependency verification for a
	single configuration or make sure resolution of configuration that
	disable that feature do not happen in builds that resolve
	configuration where the feature is enabled.</p>
      </body>
    </description>
    <references>
      <cvename>CVE-2022-23630</cvename>
      <url>https://nvd.nist.gov/vuln/detail/CVE-2022-23630</url>
    </references>
    <dates>
      <discovery>2022-02-10</discovery>
      <entry>2026-10-25</entry>
    </dates>
  </vuln>