Debian Package Tracker
Register | Log in
Subscribe

maven

Java software project management and comprehension tool

Choose email to subscribe with

general
  • source: maven (main)
  • version: 3.6.3-5
  • maintainer: Debian Java Maintainers (archive) (DMD)
  • uploaders: Emmanuel Bourg [DMD] – Stephen Kitt [DMD]
  • arch: all
  • std-ver: 4.5.1
  • VCS: Git (Browse, QA)
versions [more versions can be listed by madison] [old versions available from snapshot.debian.org]
[pool directory]
  • o-o-stable: 3.3.9-4
  • oldstable: 3.6.0-1
  • old-bpo: 3.6.3-5~bpo10+1
  • stable: 3.6.3-5
  • testing: 3.6.3-5
  • unstable: 3.6.3-5
versioned links
  • 3.3.9-4: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
  • 3.6.0-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
  • 3.6.3-5~bpo10+1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
  • 3.6.3-5: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
binaries
  • libmaven3-core-java
  • maven (3 bugs: 0, 2, 1, 0)
action needed
A new upstream version is available: 3.8.6 high
A new upstream version 3.8.6 is available, you should consider packaging it.
Created: 2022-03-01 Last update: 2022-08-10 14:37
1 security issue in sid high

There is 1 open security issue in sid.

1 important issue:
  • CVE-2021-26291: Apache Maven will follow repositories that are defined in a dependency’s Project Object Model (pom) which may be surprising to some users, resulting in potential risk if a malicious actor takes over that repository or is able to insert themselves into a position to pretend to be that repository. Maven is changing the default behavior in 3.8.1+ to no longer follow http (non-SSL) repository references by default. More details available in the referenced urls. If you are currently using a repository manager to govern the repositories used by your builds, you are unaffected by the risks present in the legacy behavior, and are unaffected by this vulnerability and change to default behavior. See this link for more information about repository management: https://maven.apache.org/repository-management.html
Created: 2022-07-04 Last update: 2022-08-01 13:40
1 security issue in bookworm high

There is 1 open security issue in bookworm.

1 important issue:
  • CVE-2021-26291: Apache Maven will follow repositories that are defined in a dependency’s Project Object Model (pom) which may be surprising to some users, resulting in potential risk if a malicious actor takes over that repository or is able to insert themselves into a position to pretend to be that repository. Maven is changing the default behavior in 3.8.1+ to no longer follow http (non-SSL) repository references by default. More details available in the referenced urls. If you are currently using a repository manager to govern the repositories used by your builds, you are unaffected by the risks present in the legacy behavior, and are unaffected by this vulnerability and change to default behavior. See this link for more information about repository management: https://maven.apache.org/repository-management.html
Created: 2022-07-04 Last update: 2022-08-01 13:40
lintian reports 13 warnings normal
Lintian reports 13 warnings about this package. You should make the package lintian clean getting rid of them.
Created: 2021-04-11 Last update: 2021-04-11 10:18
1 low-priority security issue in bullseye low

There is 1 open security issue in bullseye.

1 issue left for the package maintainer to handle:
  • CVE-2021-26291: (needs triaging) Apache Maven will follow repositories that are defined in a dependency’s Project Object Model (pom) which may be surprising to some users, resulting in potential risk if a malicious actor takes over that repository or is able to insert themselves into a position to pretend to be that repository. Maven is changing the default behavior in 3.8.1+ to no longer follow http (non-SSL) repository references by default. More details available in the referenced urls. If you are currently using a repository manager to govern the repositories used by your builds, you are unaffected by the risks present in the legacy behavior, and are unaffected by this vulnerability and change to default behavior. See this link for more information about repository management: https://maven.apache.org/repository-management.html

You can find information about how to handle this issue in the security team's documentation.

Created: 2022-07-04 Last update: 2022-08-01 13:40
Standards version of the package is outdated. wishlist
The package should be updated to follow the last version of Debian Policy (Standards-Version 4.6.1 instead of 4.5.1).
Created: 2021-08-18 Last update: 2022-05-11 23:24
news
[rss feed]
  • [2021-03-03] Accepted maven 3.6.3-5~bpo10+1 (source) into buster-backports (Sudip Mukherjee)
  • [2021-02-21] maven 3.6.3-5 MIGRATED to testing (Debian testing watch)
  • [2021-02-10] Accepted maven 3.6.3-5 (source) into unstable (Emmanuel Bourg)
  • [2021-02-09] Accepted maven 3.6.3-4 (source) into unstable (Emmanuel Bourg)
  • [2021-01-25] maven 3.6.3-3 MIGRATED to testing (Debian testing watch)
  • [2021-01-20] Accepted maven 3.6.3-1~bpo10+1 (source all) into buster-backports, buster-backports (Debian FTP Masters) (signed by: Sudip Mukherjee)
  • [2021-01-20] Accepted maven 3.6.3-3 (source) into unstable (Emmanuel Bourg)
  • [2021-01-19] Accepted maven 3.6.3-2 (source) into unstable (Emmanuel Bourg)
  • [2020-02-02] maven 3.6.3-1 MIGRATED to testing (Debian testing watch)
  • [2020-01-27] Accepted maven 3.6.3-1 (source) into unstable (Emmanuel Bourg)
  • [2019-09-14] maven 3.6.2-1 MIGRATED to testing (Debian testing watch)
  • [2019-09-08] Accepted maven 3.6.2-1 (source) into unstable (Emmanuel Bourg)
  • [2019-09-07] maven 3.6.1-1 MIGRATED to testing (Debian testing watch)
  • [2019-07-20] Accepted maven 3.6.1-1 (source) into unstable (Emmanuel Bourg)
  • [2018-11-24] maven 3.6.0-1 MIGRATED to testing (Debian testing watch)
  • [2018-11-19] Accepted maven 3.6.0-1 (source) into unstable (Emmanuel Bourg)
  • [2018-10-10] maven 3.5.4-1 MIGRATED to testing (Debian testing watch)
  • [2018-10-05] Accepted maven 3.5.4-1 (source) into unstable (Emmanuel Bourg)
  • [2018-06-19] maven 3.5.3-1 MIGRATED to testing (Debian testing watch)
  • [2018-06-13] Accepted maven 3.5.3-1 (source) into unstable (Emmanuel Bourg)
  • [2018-03-05] maven 3.5.2-2 MIGRATED to testing (Debian testing watch)
  • [2018-02-23] Accepted maven 3.5.2-2 (source) into unstable (Emmanuel Bourg)
  • [2018-02-22] Accepted maven 3.5.2-1 (source) into unstable (Stephen Kitt)
  • [2017-11-17] maven 3.5.0-8 MIGRATED to testing (Debian testing watch)
  • [2017-11-11] Accepted maven 3.5.0-8 (source) into unstable (Miguel Landaeta)
  • [2017-11-11] Accepted maven 3.5.0-7 (source) into unstable (Emmanuel Bourg)
  • [2017-09-12] maven 3.5.0-6 MIGRATED to testing (Debian testing watch)
  • [2017-09-07] Accepted maven 3.5.0-6 (source all) into unstable (Emmanuel Bourg)
  • [2017-07-10] maven 3.5.0-5 MIGRATED to testing (Debian testing watch)
  • [2017-07-05] Accepted maven 3.5.0-5 (source) into unstable (Emmanuel Bourg)
  • 1
  • 2
bugs [bug history graph]
  • all: 4
  • RC: 0
  • I&N: 3
  • M&W: 1
  • F&P: 0
  • patch: 0
links
  • homepage
  • lintian (0, 13)
  • buildd: logs, clang, reproducibility
  • popcon
  • browse source code
  • edit tags
  • other distros
  • security tracker
  • screenshots
ubuntu Ubuntu logo [Information about Ubuntu for Debian Developers]
  • version: 3.6.3-5
  • 15 bugs

Debian Package Tracker — Copyright 2013-2018 The Distro Tracker Developers
Report problems to the tracker.debian.org pseudo-package in the Debian BTS.
Documentation — Bugs — Git Repository — Contributing