Apache Maven Multiple Security Bypass Vulnerabilities

[it0001]

CVE Numbers

CVE‑2021‑26291 <https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-26291> , CVE‑2020‑13956 <https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-13956>

Description

Multiple vulnerabilities have been reported in Apache Maven, which can be exploited by malicious people to bypass certain security restrictions.

1

An error when resolving custom repositories in dependency POMs over HTTP instead of HTTPS can be exploited to e.g. conduct a MitM (Man-in-the-Middle) attack.

The vulnerabilities are reported in versions prior to 3.8.1.

Affected Software

The following software is affected by the described vulnerability. Please check the vendor links below to see if exactly your version is affected.

Solution

Update to version 3.8.1.

References

1. http://maven.apache.org/docs/3.8.1/release-notes.html <http://maven.apache.org/docs/3.8.1/release-notes.html>

Please provide a solution as soon as possible.

[Eduardo Barretto (ebarretto)]

Thanks for taking the time to report this bug and helping to make Ubuntu better. Since the packages referred to in this bug is in universe or multiverse, it is community maintained. If you are able, I suggest coordinating with upstream and posting a debdiff for this issue. When a debdiff is available, members of the security team will review it and publish the package. See the following link for more information: https://wiki.ubuntu.com/SecurityTeam/UpdateProcedures

[Eduardo Barretto (ebarretto)]

That is already fixed under Ubuntu Pro:
https://ubuntu.com/security/notices/USN-5245-1
https://ubuntu.com/security/notices/USN-5239-1

[Vladimir Petko (vpa1977)]

I have tried to apply debdiff for maven_focal.debdiff[1]

--------------------
$ debdiff-apply < ../maven_focal.debdiff
Traceback (most recent call last):
  File "/usr/bin/debdiff-apply", line 382, in <module>
    sys.exit(main(sys.argv[1:]))
             ^^^^^^^^^^^^^^^^^^
  File "/usr/bin/debdiff-apply", line 312, in main
    patch = unidiff.PatchSet(data.splitlines(keepends=True), encoding=enc)
            ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/lib/python3/dist-packages/unidiff/patch.py", line 460, in __init__
    self._parse(data, encoding=encoding, metadata_only=metadata_only)
  File "/usr/lib/python3/dist-packages/unidiff/patch.py", line 548, in _parse
    current_file._parse_hunk(line, diff, encoding, metadata_only)
  File "/usr/lib/python3/dist-packages/unidiff/patch.py", line 316, in _parse_hunk
    raise UnidiffParseError(
unidiff.errors.UnidiffParseError: Hunk diff line expected: diff -Nru maven-3.6.3/debian/control maven-3.6.3/debian/control

--------------------

[1] https://bugs.launchpad.net/ubuntu/+source/maven/+bug/1922654/+attachment/5697379/+files/maven_focal.debdiff

[Eduardo Barretto (ebarretto)]

This patch is not acceptable as you are trying to fix a security issue (already fixed) and a bug issue. Please only upload a debdiff for the bug issue.
Also create a new ticket for that, as this one if for the security issue and that was already fixed.