Activity log for bug #1922654

Date Who What changed Old value New value Message
2021-04-06 07:54:32 it0001 bug added bug
2021-04-06 07:55:55 it0001 description Description Multiple vulnerabilities have been reported in Apache Maven, which can be exploited by malicious people to bypass certain security restrictions. 1 An error when resolving custom repositories in dependency POMs over HTTP instead of HTTPS can be exploited to e.g. conduct a MitM (Man-in-the-Middle) attack. The vulnerabilities are reported in versions prior to 3.8.1. Affected Software The following software is affected by the described vulnerability. Please check the vendor links below to see if exactly your version is affected. Solution Update to version 3.8.1. References 1. http://maven.apache.org/docs/3.8.1/release-notes.html <http://maven.apache.org/docs/3.8.1/release-notes.html> Please provide a solution as soon as possible. CVE Numbers CVE‑2021‑26291 <https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-26291> , CVE‑2020‑13956 <https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-13956> Description Multiple vulnerabilities have been reported in Apache Maven, which can be exploited by malicious people to bypass certain security restrictions. 1 An error when resolving custom repositories in dependency POMs over HTTP instead of HTTPS can be exploited to e.g. conduct a MitM (Man-in-the-Middle) attack. The vulnerabilities are reported in versions prior to 3.8.1. Affected Software The following software is affected by the described vulnerability. Please check the vendor links below to see if exactly your version is affected. Solution Update to version 3.8.1. References 1. http://maven.apache.org/docs/3.8.1/release-notes.html <http://maven.apache.org/docs/3.8.1/release-notes.html> Please provide a solution as soon as possible.
2021-04-06 20:47:16 Seth Arnold information type Private Security Public Security
2021-04-06 20:47:17 Seth Arnold bug added subscriber Ubuntu Bugs
2021-04-20 12:56:17 Eduardo Barretto bug task added httpcomponents-client (Ubuntu)
2021-04-20 12:57:55 Eduardo Barretto httpcomponents-client (Ubuntu): status New Confirmed
2021-04-20 12:57:59 Eduardo Barretto maven (Ubuntu): status New Confirmed