https://bugzilla.redhat.com/show_bug.cgi?id=1955739
--- Doc Text *updated* by Eric Christensen sparks@redhat.com --- A flaw was found in maven. Repositories that are defined in a dependency’s Project Object Model (pom), which may be unknown to users, are used by default resulting in potential risk if a malicious actor takes over that repository or is able to insert themselves into a position to pretend to be that repository. The highest threat from this vulnerability is to data confidentiality and integrity.