PT-2013-2190 · Apache · Apache Maven+1

Graham Leggett · Published 2013-04-09 · Updated 2019-04-16 · CVE-2013-0253

Positive Technologies (AI Summary)

CVSS v2.0

5.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Apache Maven version 3.0.4

Description The default configuration of Apache Maven, when using Maven Wagon 2.1, has a security issue where SSL certificate checks are disabled. This allows remote attackers to spoof servers via a man-in-the-middle (MITM) attack.

Recommendations For Apache Maven version 3.0.4, consider enabling SSL certificate checks to prevent man-in-the-middle attacks. As a temporary workaround, restrict the use of Maven Wagon 2.1 until a secure configuration or update is available.

Fix

Weakness Enumeration

CWE-16

Related Identifiers

CVE-2013-0253

RHSA-2013:0700

Affected Products

Apache Maven

Maven Wagon

References · 10

• https://nvd.nist.gov/vuln/detail/CVE-2013-0253 · Security Note
• https://ubuntu.com/security/CVE-2013-0253 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2013-0253 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2013-0253 · Vendor Advisory
• https://maven.apache.org/security.html · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2013-0700.html · Vendor Advisory
• http://maven.apache.org/docs/3.0.5/release-notes.html · Note
• https://lists.apache.org/thread.html/ff8dcfe29377088ab655fda9d585dccd5b1f07fabd94ae84fd60a7f8%40%3Ccommits.pulsar.apache.org%3E · Note
• http://maven.apache.org/security.html · Note
• https://bugzilla.redhat.com/show_bug.cgi?id=917084 · Note