ALEA-2020:4748 maven:3.6 bug fix and enhancement update

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section...

maven:3.6 bug fix and enhancement update

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section...

CVE-2020-10721

A flaw was found in the fabric8-maven-plugin 4.0.0 and later. When using a wildfly-swarm or thorntail custom configuration, a malicious YAML configuration file on the local machine executing the maven plug-in could allow for deserialization of untrusted data resulting in arbitrary code execution...

CVE-2020-10721

A flaw was found in the fabric8-maven-plugin 4.0.0 and later. When using a wildfly-swarm or thorntail custom configuration, a malicious YAML configuration file on the local machine executing the maven plug-in could allow for deserialization of untrusted data resulting in arbitrary code execution...

Deserialization of untrusted data

A flaw was found in the fabric8-maven-plugin 4.0.0 and later. When using a wildfly-swarm or thorntail custom configuration, a malicious YAML configuration file on the local machine executing the maven plug-in could allow for deserialization of untrusted data resulting in arbitrary code execution...

CVE-2020-10721

CVE-2020-10721 affects the fabric8-maven-plugin (4.0.0 and later). The vulnerability arises when using a wildfly-swarm or thorntail custom configuration, where a malicious YAML file on the machine running the Maven plugin can trigger deserialization of untrusted data, enabling arbitrary code exec...

CVE-2020-10721

A flaw was found in the fabric8-maven-plugin 4.0.0 and later. When using a wildfly-swarm or thorntail custom configuration, a malicious YAML configuration file on the local machine executing the maven plug-in could allow for deserialization of untrusted data resulting in arbitrary code execution...

CVE-2020-10721

A flaw was found in the fabric8-maven-plugin 4.0.0 and later. When using a wildfly-swarm or thorntail custom configuration, a malicious YAML configuration file on the local machine executing the maven plug-in could allow for deserialization of untrusted data resulting in arbitrary code execution...

OS Command Injection

maven-shared-utils is vulnerable to OS command injection. An attacker is able to inject and execute arbitrary OS commands on the host OS via the Commandline class due to insecure validation and escaping of double-quoted strings...

CVE-2020-2295

A cross-site request forgery CSRF vulnerability in Jenkins Maven Cascade Release Plugin 1.3.2 and earlier allows attackers to start cascade builds and layout builds, and reconfigure the plugin...

CVE-2020-2295

A cross-site request forgery CSRF vulnerability in Jenkins Maven Cascade Release Plugin 1.3.2 and earlier allows attackers to start cascade builds and layout builds, and reconfigure the plugin...

CVE-2020-2294

Jenkins Maven Cascade Release Plugin 1.3.2 and earlier does not perform permission checks in several HTTP endpoints, allowing attackers with Overall/Read permission to start cascade builds and layout builds, and reconfigure the plugin...

CVE-2020-2294

Jenkins Maven Cascade Release Plugin 1.3.2 and earlier does not perform permission checks in several HTTP endpoints, allowing attackers with Overall/Read permission to start cascade builds and layout builds, and reconfigure the plugin...

Cross site request forgery (csrf)

A cross-site request forgery CSRF vulnerability in Jenkins Maven Cascade Release Plugin 1.3.2 and earlier allows attackers to start cascade builds and layout builds, and reconfigure the plugin...

Design/Logic Flaw

Jenkins Maven Cascade Release Plugin 1.3.2 and earlier does not perform permission checks in several HTTP endpoints, allowing attackers with Overall/Read permission to start cascade builds and layout builds, and reconfigure the plugin...

CVE-2020-2294

CVE-2020-2294 affects Jenkins Maven Cascade Release Plugin (versions 1.3.2 and earlier). The root cause is missing permission checks on several HTTP endpoints, enabling users with Overall/Read to start cascade builds, layout builds, and reconfigure the plugin. Reported impact per sources includes...

CVE-2020-2294

Jenkins Maven Cascade Release Plugin 1.3.2 and earlier does not perform permission checks in several HTTP endpoints, allowing attackers with Overall/Read permission to start cascade builds and layout builds, and reconfigure the plugin...

CVE-2020-2295

A CSRF vulnerability affects Jenkins Maven Cascade Release Plugin 1.3.2 and earlier, allowing an attacker to start cascade/layout builds and reconfigure the plugin. Root cause: missing CSRF protection in the plugin’s request handling. Impact: unauthorized build actions and plugin reconfiguration....

PT-2020-15525 · Jenkins · Jenkins Maven Cascade Release Plugin

Name of the Vulnerable Software and Affected Versions: Jenkins Maven Cascade Release Plugin versions 1.3.2 and earlier Description: A cross-site request forgery issue allows attackers to start cascade builds and layout builds, and reconfigure the plugin. Recommendations: For Jenkins Maven Cascade...

CloudBees Jenkins Pipeline Maven Integration Cross Site Scripting Vulnerability

CloudBees Jenkins Hudson Labs is the United States CloudBees company a set of Java-based development of continuous integration tools . The product is mainly used to monitor the continuous software version release/testing project and some timed execution of the task . A cross-site scripting...