-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 ===================================================================== Red Hat Security Advisory Synopsis: Moderate: maven:3.6 security and enhancement update Advisory ID: RHSA-2022:1860-01 Product: Red Hat Enterprise Linux Advisory URL: https://access.redhat.com/errata/RHSA-2022:1860 Issue date: 2022-05-10 CVE Names: CVE-2020-13956 ===================================================================== 1. Summary: An update for the maven:3.6 module is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Relevant releases/architectures: Red Hat Enterprise Linux AppStream (v. 8) - noarch 3. Description: Maven is a software project management and comprehension tool. Based on the concept of a project object model (POM), Maven can manage a project's build, reporting and documentation from a central piece of information. Security Fix(es): * apache-httpclient: incorrect handling of malformed authority component in request URIs (CVE-2020-13956) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.6 Release Notes linked from the References section. 4. Solution: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 5. Bugs fixed (https://bugzilla.redhat.com/): 1886587 - CVE-2020-13956 apache-httpclient: incorrect handling of malformed authority component in request URIs 1991521 - maven dependencies will need to be satisfiable by openjdk17 in RHEL 8 6. Package List: Red Hat Enterprise Linux AppStream (v. 8): Source: aopalliance-1.0-20.module+el8.6.0+13337+afcb49ec.src.rpm apache-commons-cli-1.4-7.module+el8.6.0+13337+afcb49ec.src.rpm apache-commons-codec-1.13-3.module+el8.6.0+13337+afcb49ec.src.rpm apache-commons-io-2.6-6.module+el8.6.0+13337+afcb49ec.src.rpm apache-commons-lang3-3.9-4.module+el8.6.0+13337+afcb49ec.src.rpm atinject-1-31.20100611svn86.module+el8.6.0+13337+afcb49ec.src.rpm cdi-api-2.0.1-3.module+el8.6.0+13337+afcb49ec.src.rpm geronimo-annotation-1.0-26.module+el8.6.0+13337+afcb49ec.src.rpm google-guice-4.2.2-4.module+el8.6.0+13337+afcb49ec.src.rpm guava-28.1-3.module+el8.6.0+13337+afcb49ec.src.rpm httpcomponents-client-4.5.10-4.module+el8.6.0+13337+afcb49ec.src.rpm httpcomponents-core-4.4.12-3.module+el8.6.0+13337+afcb49ec.src.rpm jansi-1.18-4.module+el8.6.0+13337+afcb49ec.src.rpm jsoup-1.12.1-3.module+el8.6.0+13337+afcb49ec.src.rpm jsr-305-0-0.25.20130910svn.module+el8.6.0+13337+afcb49ec.src.rpm maven-3.6.2-7.module+el8.6.0+13337+afcb49ec.src.rpm maven-resolver-1.4.1-3.module+el8.6.0+13337+afcb49ec.src.rpm maven-shared-utils-3.2.1-0.4.module+el8.6.0+13337+afcb49ec.src.rpm maven-wagon-3.3.4-2.module+el8.6.0+13337+afcb49ec.src.rpm plexus-cipher-1.7-17.module+el8.6.0+13337+afcb49ec.src.rpm plexus-classworlds-2.6.0-4.module+el8.6.0+13337+afcb49ec.src.rpm plexus-containers-2.1.0-2.module+el8.6.0+13337+afcb49ec.src.rpm plexus-interpolation-1.26-3.module+el8.6.0+13337+afcb49ec.src.rpm plexus-sec-dispatcher-1.4-29.module+el8.6.0+13337+afcb49ec.src.rpm plexus-utils-3.3.0-3.module+el8.6.0+13337+afcb49ec.src.rpm sisu-0.3.4-2.module+el8.6.0+13337+afcb49ec.src.rpm slf4j-1.7.28-3.module+el8.6.0+13337+afcb49ec.src.rpm noarch: aopalliance-1.0-20.module+el8.6.0+13337+afcb49ec.noarch.rpm apache-commons-cli-1.4-7.module+el8.6.0+13337+afcb49ec.noarch.rpm apache-commons-codec-1.13-3.module+el8.6.0+13337+afcb49ec.noarch.rpm apache-commons-io-2.6-6.module+el8.6.0+13337+afcb49ec.noarch.rpm apache-commons-lang3-3.9-4.module+el8.6.0+13337+afcb49ec.noarch.rpm atinject-1-31.20100611svn86.module+el8.6.0+13337+afcb49ec.noarch.rpm cdi-api-2.0.1-3.module+el8.6.0+13337+afcb49ec.noarch.rpm geronimo-annotation-1.0-26.module+el8.6.0+13337+afcb49ec.noarch.rpm google-guice-4.2.2-4.module+el8.6.0+13337+afcb49ec.noarch.rpm guava-28.1-3.module+el8.6.0+13337+afcb49ec.noarch.rpm httpcomponents-client-4.5.10-4.module+el8.6.0+13337+afcb49ec.noarch.rpm httpcomponents-core-4.4.12-3.module+el8.6.0+13337+afcb49ec.noarch.rpm jansi-1.18-4.module+el8.6.0+13337+afcb49ec.noarch.rpm jcl-over-slf4j-1.7.28-3.module+el8.6.0+13337+afcb49ec.noarch.rpm jsoup-1.12.1-3.module+el8.6.0+13337+afcb49ec.noarch.rpm jsr-305-0-0.25.20130910svn.module+el8.6.0+13337+afcb49ec.noarch.rpm maven-3.6.2-7.module+el8.6.0+13337+afcb49ec.noarch.rpm maven-lib-3.6.2-7.module+el8.6.0+13337+afcb49ec.noarch.rpm maven-openjdk11-3.6.2-7.module+el8.6.0+13337+afcb49ec.noarch.rpm maven-openjdk17-3.6.2-7.module+el8.6.0+13337+afcb49ec.noarch.rpm maven-openjdk8-3.6.2-7.module+el8.6.0+13337+afcb49ec.noarch.rpm maven-resolver-1.4.1-3.module+el8.6.0+13337+afcb49ec.noarch.rpm maven-shared-utils-3.2.1-0.4.module+el8.6.0+13337+afcb49ec.noarch.rpm maven-wagon-3.3.4-2.module+el8.6.0+13337+afcb49ec.noarch.rpm plexus-cipher-1.7-17.module+el8.6.0+13337+afcb49ec.noarch.rpm plexus-classworlds-2.6.0-4.module+el8.6.0+13337+afcb49ec.noarch.rpm plexus-containers-component-annotations-2.1.0-2.module+el8.6.0+13337+afcb49ec.noarch.rpm plexus-interpolation-1.26-3.module+el8.6.0+13337+afcb49ec.noarch.rpm plexus-sec-dispatcher-1.4-29.module+el8.6.0+13337+afcb49ec.noarch.rpm plexus-utils-3.3.0-3.module+el8.6.0+13337+afcb49ec.noarch.rpm sisu-0.3.4-2.module+el8.6.0+13337+afcb49ec.noarch.rpm slf4j-1.7.28-3.module+el8.6.0+13337+afcb49ec.noarch.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/ 7. References: https://access.redhat.com/security/cve/CVE-2020-13956 https://access.redhat.com/security/updates/classification/#moderate https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/8.6_release_notes/ 8. Contact: The Red Hat security contact is . More contact details at https://access.redhat.com/security/team/contact/ Copyright 2022 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIVAwUBYnqRM9zjgjWX9erEAQje1Q//fXQupsTrVoe9HwBnsdE0sdwUmLNfnf+f pcqaS6TKYwDycMkY6G4kBKzUtwTBl3qEzwrxQvtIpAAiKPy4w/cZWb025B4Bgl09 wufgcNJ+YnEg3crwZvAs2ZZkJ1A6dtiO8Viu6r91c1V2HQJISrheD0z36DmONxQU I7AyBI6YL1bgDhDn3mpRBzZYO7uxUqUAX5gOJhve9Cu2qMIQqU8E0/vqrkEMq0Pv hEwkFX1fiElS/7DRPmPWduhYkjWBGNUnMHSeHVxzBGuWH0PxcPPaYf6lkMNFNQvn nF182Wd8z3eNmy8jXyLe/8r8JT8ZDwEaCtpAgqsDGhhMGpEklzdpBSNeb1tEGDM+ ldYKwwHDaxBchzkoyW4MGW3TAAWATG3WQ7uqipWQ8Vlqji/iVVZI0S2ez+Hxqizs C0Djlx4HEm/WIrN7ufkJUxBrPyqxaU1TJB+BkrUzc98F37IJLaRoadrjVcj6ECqH NiectRYtOJjOe2xgF7Y4n0v1aoe1neI1WADxZ2vQ75JiYpuTv98gtEFocaM+I2pd STvj0hgOlESuXidN1mRQHy+FqJaOf2H4gtJKPJ0uS9A0RZ/N8ei/Y6ztXL/0smn4 EiQLV80wx3yoUmR7dyUrOoGr2DZXeRY78JO7FT77hVDs60rC+1pzEInRD0oz2BhQ +3TyxxLlyac= =1bhp -----END PGP SIGNATURE----- -- RHSA-announce mailing list RHSA-announce@redhat.com https://listman.redhat.com/mailman/listinfo/rhsa-announce