Security Bulletin: DataStage on Cloud Pak for Data is vulnerable to security restriction bypass due to the Apache Maven package (CVE-2021-26291)

Summary Apache Maven is used by DataStage on Cloud Pak for Data as part of build management. Vulnerability Details CVEID:CVE-2021-26291 DESCRIPTION: Apache Maven could allow a remote attacker to bypass security restrictions, caused by the use of http non-SSL repository references by default. By...

CVE-2021-26291 affecting package javapackages-bootstrap for versions less than 1.5.0-6

CVE-2021-26291 affecting package javapackages-bootstrap for versions less than 1.5.0-6. A patched version of the package is available...

Security Bulletin: IBM InfoSphere Information Server is affected by a vulnerability in Apache Maven (CVE-2021-26291)

Summary A vulnerability in Apache Maven that is used by InfoSphere Information Server was addressed. Vulnerability Details CVEID:CVE-2021-26291 DESCRIPTION: Apache Maven could allow a remote attacker to bypass security restrictions, caused by the use of http non-SSL repository references by...

Security Bulletin: Vulnerabilities in Maven affect IBM watsonx.data

Summary Apache Maven could allow a remote attacker to either bypass security restrictions or to execute arbitrary commands on the system. These can affect IBM watsonx.data. Vulnerability Details CVEID:CVE-2021-26291 DESCRIPTION: Apache Maven could allow a remote attacker to bypass security...

Security Bulletin: IBM Integration Bus for z/OS is vulnerable to a remote attack due to Apache Maven (CVE-2021-26291)

Summary UPDATE 21 AUGUST 2024: This fix has been updated. Please download and install the fix dated 21 August 2024. The IBM Integration Bus for z/OS toolkit is vulnerable to a remote attack due to Apache Maven. This bulletin identifies the steps to take to address the vulnerability. Vulnerability...

RHEL 8 : jenkins and jenkins-2-plugins (RHSA-2023:3198)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:3198 advisory. Jenkins is a continuous integration server that monitors executions of repeated jobs, such as building a software project or jobs run by cro...

Ubuntu 16.04 ESM / 18.04 ESM / 20.04 ESM / 22.04 ESM : Apache Maven vulnerability (USN-5245-1)

The remote Ubuntu 16.04 ESM / 18.04 ESM / 20.04 ESM / 22.04 ESM host has packages installed that are affected by a vulnerability as referenced in the USN-5245-1 advisory. It was discovered that Apache Maven followed repositories that are defined in a dependency's Project Object Model pom even if...

Mageia: Security Advisory (MGASA-2023-0230)

The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Ubuntu 22.10 : Apache Maven vulnerability (USN-5805-1)

The remote Ubuntu 22.10 host has packages installed that are affected by a vulnerability as referenced in the USN-5805-1 advisory. It was discovered that Apache Maven followed repositories that are defined in a dependencys Project Object Model pom even if the repositories weren't encryptedh http...

Moderate: Red Hat Security Advisory: Red Hat build of Quarkus 2.2.3 release and security update

An update is now available for Red Hat build of Quarkus. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability. For more information...

OESA-2021-1276 maven security update

Maven is a software project management and comprehension tool. Based on the concept of a project object model POM, Maven can manage a project's build, reporting and documentation from a central piece of information. Security Fixes: Apache Maven will follow repositories that are defined in a...

app.keyconnect.api:keyconnect-api (=1.0.0), app.keyconnect:keyconnect-rippled-api (=1.0.0) +2677 more potentially affected by CVE-2021-26291 via org.apache.maven:maven-compat (>=2.2.0 <=3.6.3)

org.apache.maven:maven-compat MAVEN version =2.2.0, =2.4, =0.1-1, =0.1-2, =0.1-1, =0.1-1, =3.0.0, =4.3.0, =0.1.0, =0.6.0, =0.7.0 and more Source cves: CVE-2021-26291 Source advisory: OSV:GHSA-2F88-5HG8-9X2X...

ai.langsa:start-with-langsa-plugin (>=0.1 <=0.5), app.keyconnect.api:keyconnect-api (=1.0.0) +8328 more potentially affected by CVE-2021-26291 via org.apache.maven:maven-core (>=2.0 <=3.6.3)

org.apache.maven:maven-core MAVEN version =2.0, =0.1, =1.0.0, =1.1.1, =1.0.0, =3.0.1, =1.0, =4.1.0, =4.0.0, =4.0.10 and more Source cves: CVE-2021-26291 Source advisory: OSV:GHSA-2F88-5HG8-9X2X...

CVE-2021-26291 affecting package maven 3.5.4-13

CVE-2021-26291 affecting package maven 3.5.4-13. An upgraded version of the package is available that resolves this issue...

CVE-2021-26291

A flaw was found in maven. Repositories that are defined in a dependency’s Project Object Model pom, which may be unknown to users, are used by default resulting in potential risk if a malicious actor takes over that repository or is able to insert themselves into a position to pretend to be that...

CVE-2021-26291

Apache Maven will follow repositories that are defined in a dependency’s Project Object Model pom which may be surprising to some users, resulting in potential risk if a malicious actor takes over that repository or is able to insert themselves into a position to pretend to be that repository...

CVE-2021-26291

Apache Maven will follow repositories that are defined in a dependency’s Project Object Model pom which may be surprising to some users, resulting in potential risk if a malicious actor takes over that repository or is able to insert themselves into a position to pretend to be that repository...

CVE-2021-26291

Apache Maven will follow repositories that are defined in a dependency’s Project Object Model pom which may be surprising to some users, resulting in potential risk if a malicious actor takes over that repository or is able to insert themselves into a position to pretend to be that repository...

CVE-2021-26291

CVE-2021-26291: Apache Maven could allow a remote attacker to bypass security restrictions by default non-SSL (http) repository references. Affected IBM/Bundled deployments cite this vulnerability and provide remediation paths, including upgrading Maven-driven components to versions that include ...

CVE-2021-26291 block repositories using http by default

Apache Maven will follow repositories that are defined in a dependency’s Project Object Model pom which may be surprising to some users, resulting in potential risk if a malicious actor takes over that repository or is able to insert themselves into a position to pretend to be that repository...