GHSA-2f88-5hg8-9x2x

Source

https://github.com/advisories/GHSA-2f88-5hg8-9x2x

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/06/GHSA-2f88-5hg8-9x2x/GHSA-2f88-5hg8-9x2x.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-2f88-5hg8-9x2x

Aliases

CVE-2021-26291

Published

2021-06-16T17:32:49Z

Modified

2024-03-11T05:17:32.703329Z

Severity

9.1 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N CVSS Calculator

Summary

Origin Validation Error in Apache Maven

Details

Apache Maven will follow repositories that are defined in a dependency’s Project Object Model (pom) which may be surprising to some users, resulting in potential risk if a malicious actor takes over that repository or is able to insert themselves into a position to pretend to be that repository. Maven is changing the default behavior in 3.8.1+ to no longer follow http (non-SSL) repository references by default. More details available in the referenced urls. If you are currently using a repository manager to govern the repositories used by your builds, you are unaffected by the risks present in the legacy behavior, and are unaffected by this vulnerability and change to default behavior. See this link for more information about repository management: https://maven.apache.org/repository-management.html

Database specific

{
    "nvd_published_at": "2021-04-23T15:15:00Z",
    "cwe_ids": [
        "CWE-346"
    ],
    "severity": "CRITICAL",
    "github_reviewed": true,
    "github_reviewed_at": "2021-04-26T22:21:03Z"
}

References

Affected packages

Maven / org.apache.maven:maven-compat

Package

Name: org.apache.maven:maven-compat; View open source insights on deps.dev
Purl: pkg:maven/org.apache.maven/maven-compat

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

3.8.1

Affected versions

2.*

2.2.0

2.2.1

3.*

3.0-alpha-1

3.0-alpha-2

3.0-alpha-3

3.0-alpha-4

3.0-alpha-5

3.0-alpha-6

3.0-alpha-7

3.0-beta-1

3.0-beta-2

3.0-beta-3

3.0

3.0.1

3.0.2

3.0.3

3.0.4

3.0.5

3.1.0-alpha-1

3.1.0

3.1.1

3.2.1

3.2.2

3.2.3

3.2.5

3.3.1

3.3.3

3.3.9

3.5.0-alpha-1

3.5.0-beta-1

3.5.0

3.5.2

3.5.3

3.5.4

3.6.0

3.6.1

3.6.2

3.6.3

Maven / org.apache.maven:maven-core

Package

Name: org.apache.maven:maven-core; View open source insights on deps.dev
Purl: pkg:maven/org.apache.maven/maven-core

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

3.8.1

Affected versions

2.*

2.0-alpha-1

2.0-alpha-2

2.0-alpha-3

2.0-beta-1

2.0-beta-2

2.0-beta-3

2.0

2.0.1

2.0.2

2.0.3

2.0.4

2.0.5

2.0.6

2.0.7

2.0.8

2.0.9

2.0.10

2.0.11

2.1.0-M1

2.1.0