MinimalReproducer

After significant efforts, stripped it down to a minimal replicator. This is just an empty project to demonstrate the issue with dependency-check-maven usage I am forced on doing by my company rules. Do check the pom.xml and do verify: mvn org.owasp:dependency-check-maven:RELEASE:aggregate Or if...

Security Bulletin: DataStage on Cloud Pak for Data is vulnerable to security restriction bypass due to the Apache Maven package (CVE-2021-26291)

Summary Apache Maven is used by DataStage on Cloud Pak for Data as part of build management. Vulnerability Details CVEID:CVE-2021-26291 DESCRIPTION: Apache Maven could allow a remote attacker to bypass security restrictions, caused by the use of http non-SSL repository references by default. By...

CVE-2021-26291 affecting package javapackages-bootstrap for versions less than 1.5.0-6

CVE-2021-26291 affecting package javapackages-bootstrap for versions less than 1.5.0-6. A patched version of the package is available...

Security Bulletin: IBM InfoSphere Information Server is affected by a vulnerability in Apache Maven (CVE-2021-26291)

Summary A vulnerability in Apache Maven that is used by InfoSphere Information Server was addressed. Vulnerability Details CVEID:CVE-2021-26291 DESCRIPTION: Apache Maven could allow a remote attacker to bypass security restrictions, caused by the use of http non-SSL repository references by...

Security Bulletin: Vulnerabilities in Maven affect IBM watsonx.data

Summary Apache Maven could allow a remote attacker to either bypass security restrictions or to execute arbitrary commands on the system. These can affect IBM watsonx.data. Vulnerability Details CVEID:CVE-2021-26291 DESCRIPTION: Apache Maven could allow a remote attacker to bypass security...

Security Bulletin: IBM Integration Bus for z/OS is vulnerable to a remote attack due to Apache Maven (CVE-2021-26291)

Summary UPDATE 21 AUGUST 2024: This fix has been updated. Please download and install the fix dated 21 August 2024. The IBM Integration Bus for z/OS toolkit is vulnerable to a remote attack due to Apache Maven. This bulletin identifies the steps to take to address the vulnerability. Vulnerability...

RHEL 8 : jenkins and jenkins-2-plugins (RHSA-2023:3198)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:3198 advisory. Jenkins is a continuous integration server that monitors executions of repeated jobs, such as building a software project or jobs run by cro...

Ubuntu 16.04 ESM / 18.04 ESM / 20.04 ESM / 22.04 ESM : Apache Maven vulnerability (USN-5245-1)

The remote Ubuntu 16.04 ESM / 18.04 ESM / 20.04 ESM / 22.04 ESM host has packages installed that are affected by a vulnerability as referenced in the USN-5245-1 advisory. It was discovered that Apache Maven followed repositories that are defined in a dependency's Project Object Model pom even if...

Mageia: Security Advisory (MGASA-2023-0230)

The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Ubuntu 22.10 : Apache Maven vulnerability (USN-5805-1)

The remote Ubuntu 22.10 host has packages installed that are affected by a vulnerability as referenced in the USN-5805-1 advisory. It was discovered that Apache Maven followed repositories that are defined in a dependencys Project Object Model pom even if the repositories weren't encryptedh http...

Moderate: Red Hat Security Advisory: Red Hat build of Quarkus 2.2.3 release and security update

An update is now available for Red Hat build of Quarkus. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability. For more information...

OESA-2021-1276 maven security update

Maven is a software project management and comprehension tool. Based on the concept of a project object model POM, Maven can manage a project's build, reporting and documentation from a central piece of information. Security Fixes: Apache Maven will follow repositories that are defined in a...

org.codehaus.modello:modello-test (1.0-alpha-2), plexus:plexus-cdc (1.0-alpha-1) potentially affected by CVE-2021-26291 via org.apache.maven:maven-core (2.0-alpha-2)

org.apache.maven:maven-core MAVEN version 2.0-alpha-2 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.maven:maven-core and may be impacted: - org.codehaus.modello:modello-test 1.0-alpha-2 - plexus:plexus-cdc 1.0-alpha-1 Source cves:...

com.cloudbees:maven-license-plugin (>=1.2, <=1.12), com.custardsource.dybdob:dybdob-sonar-plugin (>=1.0.0, <=1.0.5) +216 more potentially affected by CVE-2021-26291 via org.apache.maven:maven-core (2.0)

org.apache.maven:maven-core MAVEN version 2.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.maven:maven-core and may be impacted: - com.cloudbees:maven-license-plugin =1.2, =1.0.0, =0.2.0, =1.2.0, =1.0.0, =1.1.2, =2.5, =1.0, =1.0-alpha-1,...

org.apache.maven:maven-embedder (2.0.3) potentially affected by CVE-2021-26291 via org.apache.maven:maven-core (2.0.3)

org.apache.maven:maven-core MAVEN version 2.0.3 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.maven:maven-core and may be impacted: - org.apache.maven:maven-embedder 2.0.3 Source cves: CVE-2021-26291 Source advisory: OSV:GHSA-2F88-5HG8-9X2...

ch.hortis.sonar:sonar-maven-plugin (>=0.2, <=1.0.2), com.exadel.flamingo.maven.plugin:flamingoapp (>=1.0.0, <=1.5.0) +82 more potentially affected by CVE-2021-26291 via org.apache.maven:maven-core (2.0.4)

org.apache.maven:maven-core MAVEN version 2.0.4 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.maven:maven-core and may be impacted: - ch.hortis.sonar:sonar-maven-plugin =0.2, =1.0.0, =1.1-beta, =3.2, =3.2, =2.2.4, =2.4.1, =2.1, =3.1.2,...

org.apache.maven.continuum:continuum-core (>=1.1-beta-1, <=1.1-beta-2), org.apache.maven.continuum:continuum-notifier-wagon (>=1.1-beta-1, <=1.1-beta-2) +12 more potentially affected by CVE-2021-26291 via org.apache.maven:maven-core (2.0.5)

org.apache.maven:maven-core MAVEN version 2.0.5 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.maven:maven-core and may be impacted: - org.apache.maven.continuum:continuum-core =1.1-beta-1, =1.1-beta-1, =1.1-beta-1, =1.0-alpha-1,...

br.com.ingenieux.launchify:launchify-hashdot (0.0.1), br.com.ingenieux.launchify:launchify-launch4j (0.0.1) +159 more potentially affected by CVE-2021-26291 via org.apache.maven:maven-core (2.0.6)

org.apache.maven:maven-core MAVEN version 2.0.6 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.maven:maven-core and may be impacted: - br.com.ingenieux.launchify:launchify-hashdot 0.0.1 - br.com.ingenieux.launchify:launchify-launch4j 0.0.1 ...

com.alibaba.citrus.tool:maven-util (1.2), com.github.mkolisnyk:muto (0.0.2) +35 more potentially affected by CVE-2021-26291 via org.apache.maven:maven-core (2.0.8)

org.apache.maven:maven-core MAVEN version 2.0.8 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.maven:maven-core and may be impacted: - com.alibaba.citrus.tool:maven-util 1.2 - com.github.mkolisnyk:muto 0.0.2 -...

at.craftworks.tools.maven:jooq-codegen-postgres-maven-plugin (0.0.3), biz.paluch.maven.configurator:configurator-maven-plugin (>=1.0, <=1.0.1) +328 more potentially affected by CVE-2021-26291 via org.apache.maven:maven-core (2.0.9)

org.apache.maven:maven-core MAVEN version 2.0.9 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.maven:maven-core and may be impacted: - at.craftworks.tools.maven:jooq-codegen-postgres-maven-plugin 0.0.3 -...