CVSS: 9.1EPSS: 0%CPEs: 5EXPL: 1CVE-2021-26291 – block repositories using http by default
https://notcve.org/view.php?id=CVE-2021-26291
Apache Maven will follow repositories that are defined in a dependency’s Project Object Model (pom) which may be surprising to some users, resulting in potential risk if a malicious actor takes over that repository or is able to insert themselves into a position to pretend to be that repository. Maven is changing the default behavior in 3.8.1+ to no longer follow http (non-SSL) repository references by default. More details available in the referenced urls. If you are currently using a repository manager to govern the repositories used by your builds, you are unaffected by the risks present in the legacy behavior, and are unaffected by this vulnerability and change to default behavior. See this link for more information about repository management: https://maven.apache.org/repository-management.html Apache Maven seguirá los repositorios que se definen en el Project Object Model (pom) de una dependencia, lo que puede resultar sorprendente para algunos usuarios, resultando en un riesgo potencial si un actor malicioso se hace cargo de ese repositorio o es capaz de insertarse en una posición para fingir ser ese repositorio. • http://www.openwall.com/lists/oss-security/2021/04/23/5 https://lists.apache.org/thread.html/r0556ce5db7231025785477739ee416b169d8aff5ee9bac7854d64736%40%3Cannounce.apache.org%3E https://lists.apache.org/thread.html/r06db4057b74e0598a412734f693a34a8836ac6f06d16d139e5e1027c%40%3Cdev.maven.apache.org%3E https://lists.apache.org/thread.html/r07a89b32783f73bda6903c1f9aadeb859e5bef0a4daed6d87db8e4a9%40%3Cissues.karaf.apache.org%3E https://lists.apache.org/thread.html/r08a401f8c98a99f68d061fde6e6659d695f28d60fe4f0413bcb355b0%40%3Ccommits.druid.apache.org%3E https://lists • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CWE-346: Origin Validation Error •
CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2019-10358
https://notcve.org/view.php?id=CVE-2019-10358
Jenkins Maven Integration Plugin 3.3 and earlier did not apply build log decorators to module builds, potentially revealing sensitive build variables in the build log. El Plugin Maven Integration de Jenkins versión 3.3 y anteriores, no aplicaban decoradores de registro de compilación a las compilaciones de módulos, lo que potencialmente revelaba variables de compilación confidenciales en el registro de compilación. • http://www.openwall.com/lists/oss-security/2019/07/31/1 https://jenkins.io/security/advisory/2019-07-31/#SECURITY-713 • CWE-532: Insertion of Sensitive Information into Log File •
CVSS: 5.8EPSS: 0%CPEs: 2EXPL: 0CVE-2013-0253 – maven-wagon: all SSL certificate checking is disabled by default
https://notcve.org/view.php?id=CVE-2013-0253
The default configuration of Apache Maven 3.0.4, when using Maven Wagon 2.1, disables SSL certificate checks, which allows remote attackers to spoof servers via a man-in-the-middle (MITM) attack. La configuración por defecto de Apache Maven v3.0.4, cuando se usa Maven Wagon v2.1 deshabilita los controles de certificado SSL, lo que permite a atacantes remotos suplantar a servidoresa través de ataques Man-in-the-middle (MITM). • http://rhn.redhat.com/errata/RHSA-2013-0700.html https://bugzilla.redhat.com/show_bug.cgi?id=917084 https://lists.apache.org/thread.html/ff8dcfe29377088ab655fda9d585dccd5b1f07fabd94ae84fd60a7f8%40%3Ccommits.pulsar.apache.org%3E https://maven.apache.org/security.html https://access.redhat.com/security/cve/CVE-2013-0253 • CWE-16: Configuration •