You are viewing a plain text version of this content. The canonical link for it is here.

Posted to issues@maven.apache.org by "Slawomir Jaranowski (Jira)" <ji...@apache.org> on 2022/10/04 20:22:00 UTC

[jira] [Commented] (MWRAPPER-50) Verify checksum when downloading maven-wrapper.jar

    [ https://issues.apache.org/jira/browse/MWRAPPER-50?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17612788#comment-17612788 ] 

Slawomir Jaranowski commented on MWRAPPER-50:
---------------------------------------------

I hope that MWRAPPER-75  will resolve this issue.

> Verify checksum when downloading maven-wrapper.jar  
> ----------------------------------------------------
>
>                 Key: MWRAPPER-50
>                 URL: https://issues.apache.org/jira/browse/MWRAPPER-50
>             Project: Maven Wrapper
>          Issue Type: Bug
>          Components: Maven Wrapper Scripts
>    Affects Versions: 3.1.0
>            Reporter: Premek Vyhnal
>            Priority: Major
>
> Hi,
> Sorry if I just cannot find it
> but it seems the checksum is not checked of the `maven-wrapper.jar` downloaded here:
> [https://github.com/apache/maven-wrapper/blob/efba2bde13feeabfb42e9dc120e8a35c127baf0d/maven-wrapper-distribution/src/resources/mvnw#L207]
>  
> Checksum of the downloaded file should be checked before executing it to avoid a remote code execution attack on the developer machine.
>  



--
This message was sent by Atlassian Jira
(v8.20.10#820010)