https://bugzilla.redhat.com/show_bug.cgi?id=1955739
Bug ID: 1955739 Summary: CVE-2021-26291 maven: Block repositories using http by default Product: Security Response Hardware: All OS: Linux Status: NEW Component: vulnerability Keywords: Security Severity: medium Priority: medium Assignee: security-response-team@redhat.com Reporter: psampaio@redhat.com CC: aboyko@redhat.com, aileenc@redhat.com, akoufoud@redhat.com, alazarot@redhat.com, almorale@redhat.com, anstephe@redhat.com, asoldano@redhat.com, atangrin@redhat.com, bbaranow@redhat.com, bmaxwell@redhat.com, brian.stansberry@redhat.com, cdewolf@redhat.com, chazlett@redhat.com, darran.lofthouse@redhat.com, dkreling@redhat.com, dosoudil@redhat.com, eleandro@redhat.com, etirelli@redhat.com, fjuma@redhat.com, gvarsami@redhat.com, ibek@redhat.com, iweiss@redhat.com, java-maint-sig@lists.fedoraproject.org, java-sig-commits@lists.fedoraproject.org, jcoleman@redhat.com, jochrist@redhat.com, jperkins@redhat.com, jstastny@redhat.com, jwon@redhat.com, kaycoth@redhat.com, kconner@redhat.com, krathod@redhat.com, kverlaen@redhat.com, kwills@redhat.com, ldimaggi@redhat.com, lgao@redhat.com, mizdebsk@redhat.com, mnovotny@redhat.com, msochure@redhat.com, msrb@redhat.com, msvehla@redhat.com, nwallace@redhat.com, pjindal@redhat.com, pmackay@redhat.com, rguimara@redhat.com, rrajasek@redhat.com, rstancel@redhat.com, rsvoboda@redhat.com, rwagner@redhat.com, smaestri@redhat.com, sochotni@redhat.com, tcunning@redhat.com, tkirby@redhat.com, tom.jenkinson@redhat.com, tzimanyi@redhat.com, yborgess@redhat.com Target Milestone: --- Classification: Other
Apache Maven will follow repositories that are defined in a dependency’s Project Object Model (pom) which may be surprising to some users, resulting in potential risk if a malicious actor takes over that repository or is able to insert themselves into a position to pretend to be that repository. Maven is changing the default behavior in 3.8.1+ to no longer follow http (non-SSL) repository references by default. If you are currently using a repository manager to govern the repositories used by your builds, you are unaffected by the risks present in the legacy behavior, and are unaffected by this vulnerability and change to default behavior.
References:
https://lists.apache.org/thread.html/r9a027668558264c4897633e66bcb7784099fde... https://lists.apache.org/thread.html/r06db4057b74e0598a412734f693a34a8836ac6... https://lists.apache.org/thread.html/r9a027668558264c4897633e66bcb7784099fde... http://www.openwall.com/lists/oss-security/2021/04/23/5 https://lists.apache.org/thread.html/r0556ce5db7231025785477739ee416b169d8af... https://lists.apache.org/thread.html/ra88a0eba7f84658cefcecc0143fd8bbad52c22... https://lists.apache.org/thread.html/r3f0450dcab7e63b5f233ccfbc6fca5f1867a75...
https://bugzilla.redhat.com/show_bug.cgi?id=1955739
Pedro Sampaio psampaio@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Blocks| |1955742
https://bugzilla.redhat.com/show_bug.cgi?id=1955739
Todd Cullum tcullum@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Depends On| |1959525, 1959524, 1959527, | |1959528, 1959526
https://bugzilla.redhat.com/show_bug.cgi?id=1955739
Chess Hazlett chazlett@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Priority|medium |high CC| |tcullum@redhat.com Flags| |needinfo?(tcullum@redhat.co | |m) Severity|medium |high
https://bugzilla.redhat.com/show_bug.cgi?id=1955739
Chess Hazlett chazlett@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- CC| |lnacshon@redhat.com Flags| |needinfo?(lnacshon@redhat.c | |om)
https://bugzilla.redhat.com/show_bug.cgi?id=1955739
Cedric Buissart cbuissar@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Depends On| |1960281
https://bugzilla.redhat.com/show_bug.cgi?id=1955739
--- Comment #6 from Jonathan Christison jochrist@redhat.com --- Upstream fixing commits: MNG-7117: https://github.com/apache/maven/commit/28b4ea92d38365d0f27a5bd044ac492758014... MNG-7116: https://github.com/apache/maven/commit/3b21386c3f1ab85060f6c950fb2fb17123df8... MNG-7118: https://github.com/apache/maven/commit/67125676eef313e592da6424a9be0c90c5e6b...
https://bugzilla.redhat.com/show_bug.cgi?id=1955739
--- Doc Text *updated* by Eric Christensen sparks@redhat.com --- A flaw was found in maven. Repositories that are defined in a dependency’s Project Object Model (pom), which may be unknown to users, are used by default resulting in potential risk if a malicious actor takes over that repository or is able to insert themselves into a position to pretend to be that repository. The highest threat from this vulnerability is to data confidentiality and integrity.
https://bugzilla.redhat.com/show_bug.cgi?id=1955739
Jonathan Christison jochrist@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- CC| |avibelli@redhat.com, | |bgeorges@redhat.com, | |bibryam@redhat.com, | |clement.escoffier@redhat.co | |m, csutherl@redhat.com, | |dandread@redhat.com, | |drieden@redhat.com, | |ggaughan@redhat.com, | |gmalinko@redhat.com, | |gsmet@redhat.com, | |gzaronik@redhat.com, | |hamadhan@redhat.com, | |hbraun@redhat.com, | |janstey@redhat.com, | |jclere@redhat.com, | |jdowland@redhat.com, | |jnethert@redhat.com, | |jpallich@redhat.com, | |lthon@redhat.com, | |mszynkie@redhat.com, | |neugens@redhat.com, | |pantinor@redhat.com, | |peholase@redhat.com, | |pgallagh@redhat.com, | |probinso@redhat.com, | |rruss@redhat.com, | |sbiarozk@redhat.com, | |sdouglas@redhat.com, | |szappis@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1955739
Ted (Jong Seok) Won jwon@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Fixed In Version| |maven 3.8.1
https://bugzilla.redhat.com/show_bug.cgi?id=1955739
Ted (Jong Seok) Won jwon@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- CC|csutherl@redhat.com, | |gzaronik@redhat.com, | |jclere@redhat.com, | |szappis@redhat.com |
https://bugzilla.redhat.com/show_bug.cgi?id=1955739
lnacshon@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Flags|needinfo?(lnacshon@redhat.c | |om) |
https://bugzilla.redhat.com/show_bug.cgi?id=1955739
Todd Cullum tcullum@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Flags|needinfo?(tcullum@redhat.co | |m) |
https://bugzilla.redhat.com/show_bug.cgi?id=1955739
--- Comment #11 from Jonathan Christison jochrist@redhat.com --- This vulnerability is out of security support scope for the following products:
* Red Hat JBoss BRMS 6 * Red Hat JBoss SOA Platform 5.
Please refer to https://access.redhat.com/support/policy/updates/jboss_notes for more details.
https://bugzilla.redhat.com/show_bug.cgi?id=1955739
Joshua Mulliken jmullike@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- CC| |pdrozd@redhat.com, | |sthorger@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1955739
Paramvir jindal pjindal@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- CC|aboyko@redhat.com, | |pdrozd@redhat.com, | |sthorger@redhat.com |
https://bugzilla.redhat.com/show_bug.cgi?id=1955739
--- Comment #17 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:
Red Hat build of Quarkus 2.2.3
Via RHSA-2021:3880 https://access.redhat.com/errata/RHSA-2021:3880
https://bugzilla.redhat.com/show_bug.cgi?id=1955739
errata-xmlrpc errata-xmlrpc@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Link ID| |Red Hat Product Errata | |RHSA-2021:3880
https://bugzilla.redhat.com/show_bug.cgi?id=1955739
Product Security DevOps Team prodsec-dev@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Resolution|--- |ERRATA Status|NEW |CLOSED Last Closed| |2021-10-20 14:08:17
--- Comment #18 from Product Security DevOps Team prodsec-dev@redhat.com --- This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):
https://access.redhat.com/security/cve/cve-2021-26291
https://bugzilla.redhat.com/show_bug.cgi?id=1955739
Mikolaj Izdebski mizdebsk@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Depends On| |1955740
Referenced Bugs:
https://bugzilla.redhat.com/show_bug.cgi?id=1955740 [Bug 1955740] CVE-2021-26291 maven: Block repositories using http by default [fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id=1955739 Bug 1955739 depends on bug 1955740, which changed state.
Bug 1955740 Summary: CVE-2021-26291 maven: Block repositories using http by default [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=1955740
What |Removed |Added ---------------------------------------------------------------------------- Status|MODIFIED |CLOSED Resolution|--- |RAWHIDE
https://bugzilla.redhat.com/show_bug.cgi?id=1955739
--- Comment #19 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:
RHINT Camel-Q 2.2.1
Via RHSA-2022:1013 https://access.redhat.com/errata/RHSA-2022:1013
https://bugzilla.redhat.com/show_bug.cgi?id=1955739
errata-xmlrpc errata-xmlrpc@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Link ID| |Red Hat Product Errata | |RHSA-2022:1013
https://bugzilla.redhat.com/show_bug.cgi?id=1955739
--- Comment #20 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:
RHINT Camel-K 1.6.4
Via RHSA-2022:1029 https://access.redhat.com/errata/RHSA-2022:1029
https://bugzilla.redhat.com/show_bug.cgi?id=1955739
errata-xmlrpc errata-xmlrpc@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Link ID| |Red Hat Product Errata | |RHSA-2022:1029
https://bugzilla.redhat.com/show_bug.cgi?id=1955739
--- Comment #22 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:
Red Hat Process Automation
Via RHSA-2023:1334 https://access.redhat.com/errata/RHSA-2023:1334
https://bugzilla.redhat.com/show_bug.cgi?id=1955739
errata-xmlrpc errata-xmlrpc@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Link ID| |Red Hat Product Errata | |RHSA-2023:1334
https://bugzilla.redhat.com/show_bug.cgi?id=1955739
--- Comment #25 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:
OpenShift Developer Tools and Services for OCP 4.11
Via RHSA-2023:3198 https://access.redhat.com/errata/RHSA-2023:3198
https://bugzilla.redhat.com/show_bug.cgi?id=1955739
errata-xmlrpc errata-xmlrpc@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Link ID| |Red Hat Product Errata | |RHSA-2023:3198
https://bugzilla.redhat.com/show_bug.cgi?id=1955739
--- Comment #27 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:
OpenShift Developer Tools and Services for OCP 4.13
Via RHSA-2024:0776 https://access.redhat.com/errata/RHSA-2024:0776
https://bugzilla.redhat.com/show_bug.cgi?id=1955739
errata-xmlrpc errata-xmlrpc@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Link ID| |Red Hat Product Errata | |RHSA-2024:0776
https://bugzilla.redhat.com/show_bug.cgi?id=1955739
--- Comment #28 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:
OpenShift Developer Tools and Services for OCP 4.12
Via RHSA-2024:0778 https://access.redhat.com/errata/RHSA-2024:0778
https://bugzilla.redhat.com/show_bug.cgi?id=1955739
errata-xmlrpc errata-xmlrpc@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Link ID| |Red Hat Product Errata | |RHSA-2024:0778
java-sig-commits@lists.fedoraproject.org