Summary
It was discovered that Apache Maven followed repositories that are defined in a
dependency's Project Object Model (pom) even if the repositories weren't
encrypted (http protocol). An attacker could use this vulnerability to take
over a repository, execute arbitrary code or cause a denial of service.
Fixed packages 4
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · Pro 16.04 LTS Pro:16.04:LTS | maven | 3.3.9-3ubuntu0.1~esm1 |
| Ubuntu · Pro 18.04 LTS Pro:18.04:LTS | maven | 3.6.0-1~18.04.1ubuntu0.1~esm1 |
| Ubuntu · Pro 20.04 LTS Pro:20.04:LTS | maven | 3.6.3-1ubuntu0.1~esm1 |
| Ubuntu · Pro 22.04 LTS Pro:22.04:LTS | maven | 3.6.3-5ubuntu0.1~esm1 |
Vulnerabilities 1
-
Critical 9.1CVE-2021-26291 Public exploit
block repositories using http by default
Apache Maven will follow repositories that are defined in a dependency’s Project Object Model (pom) which may be surprising to some users, resulting in potential risk if a malicious actor takes over that repository or is able to insert themselves into a posit…
References
-
report
https://ubuntu.com/security/CVE-2021-26291