9.1 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
6.4 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:L/Au:N/C:P/I:P/A:N
0.002 Low
EPSS
Percentile
52.0%
Apache Maven will follow repositories that are defined in a dependency’s
Project Object Model (pom) which may be surprising to some users, resulting
in potential risk if a malicious actor takes over that repository or is
able to insert themselves into a position to pretend to be that repository.
Maven is changing the default behavior in 3.8.1+ to no longer follow http
(non-SSL) repository references by default. More details available in the
referenced urls. If you are currently using a repository manager to govern
the repositories used by your builds, you are unaffected by the risks
present in the legacy behavior, and are unaffected by this vulnerability
and change to default behavior. See this link for more information about
repository management: https://maven.apache.org/repository-management.html
OS | Version | Architecture | Package | Version | Filename |
---|---|---|---|---|---|
ubuntu | 14.04 | noarch | maven | < any | UNKNOWN |
ubuntu | 16.04 | noarch | maven | < 3.3.9-3ubuntu0.1~esm1 | UNKNOWN |
ubuntu | 18.04 | noarch | maven | < 3.6.0-1~18.04.1ubuntu0.1~esm1 | UNKNOWN |
ubuntu | 22.04 | noarch | maven | < 3.6.3-5ubuntu0.1~esm1 | UNKNOWN |
ubuntu | 23.10 | noarch | maven | < any | UNKNOWN |
ubuntu | 20.04 | noarch | maven | < 3.6.3-1ubuntu0.1+esm1 | UNKNOWN |
www.openwall.com/lists/oss-security/2021/04/23/5
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-26291
github.com/apache/maven/commit/67125676eef313e592da6424a9be0c90c5e6bca5 (master)
github.com/apache/maven/commit/907d53ad3264718f66ff15e1363d76b07dd0c05f (3.8.x)
issues.apache.org/jira/browse/MNG-7118
launchpad.net/bugs/cve/CVE-2021-26291
lists.apache.org/thread.html/r06db4057b74e0598a412734f693a34a8836ac6f06d16d139e5e1027c@%3Cdev.maven.apache.org%3E
lists.apache.org/thread.html/r9a027668558264c4897633e66bcb7784099fdec9f9b22c38c2442f00%40%3Cusers.maven.apache.org%3E
lists.apache.org/thread.html/r9a027668558264c4897633e66bcb7784099fdec9f9b22c38c2442f00@%3Cusers.maven.apache.org%3E
nvd.nist.gov/vuln/detail/CVE-2021-26291
security-tracker.debian.org/tracker/CVE-2021-26291
ubuntu.com/security/notices/USN-5245-1
www.openwall.com/lists/oss-security/2021/04/23/5
9.1 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
6.4 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:L/Au:N/C:P/I:P/A:N
0.002 Low
EPSS
Percentile
52.0%