CVE-2013-0253
First published: Fri Mar 01 2013(Updated: )
Apache Maven 3.0.4 (with Apache Maven Wagon 2.1) has introduced a non-secure SSL mode by default. This mode disables all SSL certificate checking, including: host name verification , date validity, and certificate chain. Not validating the certificate introduces the possibility of a man-in-the-middle attack. Version 3.0.5 corrects this flaw. External References: <a href="https://maven.apache.org/security.html">https://maven.apache.org/security.html</a>
Credit: secalert@redhat.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| redhat/maven | <3.0.5 | 3.0.5 |
| Apache Maven | =3.0.4 | |
| Apache Maven Wagon | =2.1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://maven.apache.org/security.html
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=917086
- https://bugzilla.redhat.com/show_bug.cgi/attachment.cgi?id=706362&action=diff
- https://bugzilla.redhat.com/show_bug.cgi/attachment.cgi?id=706362&action=edit
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=917084#c3
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=917084#c4
- https://rhn.redhat.com/errata/RHSA-2013-0700.html
- https://bugzilla.redhat.com/show_bug.cgi?id=917084
- http://rhn.redhat.com/errata/RHSA-2013-0700.html
- https://lists.apache.org/thread.html/ff8dcfe29377088ab655fda9d585dccd5b1f07fabd94ae84fd60a7f8@%3Ccommits.pulsar.apache.org%3E
- https://lists.apache.org/thread.html/ff8dcfe29377088ab655fda9d585dccd5b1f07fabd94ae84fd60a7f8%40%3Ccommits.pulsar.apache.org%3E
- collector/nvd-index
- agent/type
- agent/softwarecombine
- agent/first-publish-date
- collector/mitre-cve
- source/MITRE
- agent/remedy
- agent/references
- agent/weakness
- agent/last-modified-date
- agent/severity
- agent/author
- agent/description
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2013-0253
- agent/software-canonical-lookup
- agent/event
- agent/tags
- agent/trending
- vendor/apache
- canonical/apache maven
- version/apache maven/3.0.4
- canonical/apache maven wagon
- version/apache maven wagon/2.1
- package-manager/redhat