CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:L/Au:N/C:P/I:P/A:N
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
EPSS
Percentile
53.1%
Apache Maven will follow repositories that are defined in a dependency’s
Project Object Model (pom) which may be surprising to some users, resulting
in potential risk if a malicious actor takes over that repository or is
able to insert themselves into a position to pretend to be that repository.
Maven is changing the default behavior in 3.8.1+ to no longer follow http
(non-SSL) repository references by default. More details available in the
referenced urls. If you are currently using a repository manager to govern
the repositories used by your builds, you are unaffected by the risks
present in the legacy behavior, and are unaffected by this vulnerability
and change to default behavior. See this link for more information about
repository management: https://maven.apache.org/repository-management.html
OS | Version | Architecture | Package | Version | Filename |
---|---|---|---|---|---|
ubuntu | 18.04 | noarch | maven | < 3.6.0-1~18.04.1ubuntu0.1~esm1 | UNKNOWN |
ubuntu | 20.04 | noarch | maven | < 3.6.3-1ubuntu0.1+esm1 | UNKNOWN |
ubuntu | 22.04 | noarch | maven | < 3.6.3-5ubuntu0.1~esm1 | UNKNOWN |
ubuntu | 24.04 | noarch | maven | < any | UNKNOWN |
ubuntu | 14.04 | noarch | maven | < any | UNKNOWN |
ubuntu | 16.04 | noarch | maven | < 3.3.9-3ubuntu0.1~esm1 | UNKNOWN |
www.openwall.com/lists/oss-security/2021/04/23/5
github.com/apache/maven/commit/67125676eef313e592da6424a9be0c90c5e6bca5 (master)
github.com/apache/maven/commit/907d53ad3264718f66ff15e1363d76b07dd0c05f (3.8.x)
issues.apache.org/jira/browse/MNG-7118
launchpad.net/bugs/cve/CVE-2021-26291
lists.apache.org/thread.html/r06db4057b74e0598a412734f693a34a8836ac6f06d16d139e5e1027c@%3Cdev.maven.apache.org%3E
lists.apache.org/thread.html/r9a027668558264c4897633e66bcb7784099fdec9f9b22c38c2442f00%40%3Cusers.maven.apache.org%3E
lists.apache.org/thread.html/r9a027668558264c4897633e66bcb7784099fdec9f9b22c38c2442f00@%3Cusers.maven.apache.org%3E
nvd.nist.gov/vuln/detail/CVE-2021-26291
security-tracker.debian.org/tracker/CVE-2021-26291
ubuntu.com/security/notices/USN-5245-1
www.cve.org/CVERecord?id=CVE-2021-26291
www.openwall.com/lists/oss-security/2021/04/23/5
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:L/Au:N/C:P/I:P/A:N
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
EPSS
Percentile
53.1%