apache maven CVE-2021-26291 vulnerability in Apache and Other Products
Published on April 23, 2021

block repositories using http by default

product logo product logo product logo product logo
Apache Maven will follow repositories that are defined in a dependencys Project Object Model (pom) which may be surprising to some users, resulting in potential risk if a malicious actor takes over that repository or is able to insert themselves into a position to pretend to be that repository. Maven is changing the default behavior in 3.8.1+ to no longer follow http (non-SSL) repository references by default. More details available in the referenced urls. If you are currently using a repository manager to govern the repositories used by your builds, you are unaffected by the risks present in the legacy behavior, and are unaffected by this vulnerability and change to default behavior. See this link for more information about repository management: https://maven.apache.org/repository-management.html

NVD


Products Associated with CVE-2021-26291

You can be notified by email with stack.watch whenever vulnerabilities like CVE-2021-26291 are published in these products:

Apache Maven
 
Apache Kafka
 
Quarkus
 
Oracle Financial Services Analytical Applications Infrastructure
 
Oracle Goldengate Big Data Application Adapters
 

Affected Versions

Apache Software Foundation Apache Maven:

Exploit Probability

EPSS
44.32%
Percentile
97.47%

EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.