CVE-2021-26291

Origin Validation Error in Apache Maven

概要

原文の説明

取得元が公開している説明をそのまま載せています (多くは英語)。

Apache Maven will follow repositories that are defined in a dependency’s Project Object Model (pom) which may be surprising to some users, resulting in potential risk if a malicious actor takes over that repository or is able to insert themselves into a position to pretend to be that repository. Maven is changing the default behavior in 3.8.1+ to no longer follow http (non-SSL) repository references by default. More details available in the referenced urls. If you are currently using a repository manager to govern the repositories used by your builds, you are unaffected by the risks present in the legacy behavior, and are unaffected by this vulnerability and change to default behavior. See this link for more information about repository management: https://maven.apache.org/repository-management.html

出典: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV

影響パッケージ

Bitnami maven

[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"3.8.1"}]}]

Maven org.apache.maven:maven-compat

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.8.1"}]}]

Maven org.apache.maven:maven-core

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.8.1"}]}]

ディストリビューション別の修正状況

各ディストリビューションが公開している、この CVE の修正パッケージ

Debian DEBIAN-CVE-2021-26291 maven 修正版: 3.8.6-1

参照URL

メタデータ

CVE: CVE-2021-26291
GHSA: GHSA-2f88-5hg8-9x2x
公開日: 2021-06-16
SecPulse初出: 7ヶ月前
初出ソース: OSV.dev (Open Source Vulnerabilities)

CWE

CWE-346

検知ソース

OSV.dev (Open Source Vulnerabilities) 1ヶ月前