PT-2021-7897 · Apache+5 · Apache Maven+5

Published 2021-04-23 · Updated 2026-04-11 · CVE-2021-26291

Positive Technologies (AI Summary)

CVSS v2.0

9.4

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:N

Name of the Vulnerable Software and Affected Versions Apache Maven versions prior to 3.8.1

Description The issue is related to shortcomings in the mechanism of confirming the source of data in the Apache Maven framework. Exploitation of this issue may allow a remote attacker to gain unauthorized access to protected information. The problem arises because Apache Maven follows repositories defined in a dependency's Project Object Model (pom), which can pose a risk if a malicious actor takes control of that repository or inserts themselves into a position to pretend to be that repository.

Recommendations For versions prior to 3.8.1, update to version 3.8.1 or later to change the default behavior and no longer follow http (non-SSL) repository references by default. If you are currently using a repository manager to govern the repositories used by your builds, you are unaffected by the risks present in the legacy behavior. Consider using a repository manager to minimize the risk of exploitation. As a temporary workaround, consider restricting access to non-SSL repository references until the issue is resolved.

Exploit

Fix

Origin Validation Error

Weakness Enumeration

CWE-346

Related Identifiers

BDU:2023-05216

BIT-MAVEN-2021-26291

CVE-2021-26291

GHSA-2F88-5HG8-9X2X

MGASA-2023-0230

OESA-2021-1276

OPENSUSE-SU-2024:10687-1

OPENSUSE-SU-2024:11042-1

RHSA-2023:3198

RHSA-2024:0776

RHSA-2024:0778

USN-5245-1

USN-5805-1

Affected Products

Apache Maven

Astra Linux

Debian

Linuxmint

Red Os

Ubuntu

References · 131

• 🔥 https://whitesourcesoftware.com/resources/blog/maven-security-vulnerability-cve-2021-26291 · Exploit
• https://osv.dev/vulnerability/GHSA-2f88-5hg8-9x2x · Vendor Advisory
• http://repo.red-soft.ru/redos/7.3c/x86_64/updates · Vendor Advisory
• https://osv.dev/vulnerability/BIT-maven-2021-26291 · Vendor Advisory
• https://osv.dev/vulnerability/USN-5245-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-26291 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2021-1276 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:10687-1 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2021-26291 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-5245-1 · Vendor Advisory
• https://oracle.com/security-alerts/cpuapr2022.html · Patch
• https://ubuntu.com/security/notices/USN-5805-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2021-26291 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2023-0230 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-26291 · Security Note