Upstream security vulnerability in 3.0.4

[Edward Sargisson]

Apache Maven is now at 3.0.5 because of a security vulnerability allowing man-in-the-middle attacks.

http://maven.apache.org/docs/3.0.5/release-notes.html
http://maven.apache.org/security.html

Description: Ubuntu 12.04.2 LTS
Release: 12.04

maven:
  Installed: 3.0.4-2
  Candidate: 3.0.4-2
  Version table:
 *** 3.0.4-2 0
        500 http://ca.archive.ubuntu.com/ubuntu/ precise/universe amd64 Packages
        100 /var/lib/dpkg/status

[Jamie Strandboge (jdstrand)]

Thanks for taking the time to report this bug and helping to make Ubuntu better. Since the package referred to in this bug is in universe or multiverse, it is community maintained. If you are able, I suggest coordinating with upstream and posting a debdiff for this issue. When a debdiff is available, members of the security team will review it and publish the package. See the following link for more information: https://wiki.ubuntu.com/SecurityTeam/UpdateProcedures

[Edward Sargisson (esarge)]

Forgive me, is there any action planned on this defect? It's been fixed upstream for a week now and it is a security issue.

[Seth Arnold (seth-arnold)]

Edward, no one has announced here that an update is in progress. If you wanted to prepare one, it seems unlikely that you would duplicate someone else's work. The link in comment #1 provides some information on how to prepare updates.

Thanks

[Edward Sargisson (esarge)]

I looked into this and sadly, I don't think I can justify spending my employer's time one this so I shall have to decline.

[Brad Hards (bradh)]

Upstream fixed the problem 6 months ago. Can this be released in ubuntu, please?

[Andreas Schildbach (schildbach)]

Trusty Tahr has Maven 3.0.5. Maybe it's easier to upgrade your distro.

[Christopher Currie (codemonkey-n)]

This may not actually be an issue for 12.04. From the debian-java list:

> If precise doesn't have libwagon2-java you are probably safe. The
> description of CVE-2013-0253 states that wagon was vulnerable starting
> with the version 2.1. And looking at the patch for wagon 2 [2], none of
> the code modified exists in wagon 1.

[1] https://lists.debian.org/debian-java/2015/02/msg00003.html
[2] https://sources.debian.net/src/wagon2/2.2-3%2Bnmu1/debian/patches/cve-2013-0253.patch/

[Emmanuel Bourg (ebourg)]

Fixed in Trusty. Precise wasn't affected.