{ "cveId": "CVE-2020-13936", "url": "https://patchblox.com/security/cve/CVE-2020-13936", "summary": "CVE-2020-13936 is fixed in 20 products on 1 platform, first by velocity 1.7-5ubuntu0.18.04.1~esm1, released March 10, 2021. It is not reported as exploited. Patch Radar priority: Routine.", "title": "maven-invoker: This update for Maven fixes the following issues:\n\nmaven-dependency-analyzer was updated from version 1.13.2 to 1.15....", "description": "This update for Maven fixes the following issues:\n\nmaven-dependency-analyzer was updated from version 1.13.2 to 1.15.1:\n\n- Key changes across versions:\n * Bug fixes and improved support of dynamic types\n * Dependency upgrades (ASM, Maven core, and notably the removal of commons-io)\n * Improved error handling by logging instead of failing\n * Improved dependency usage tracking\n\nmaven-dependency-plugin was updated from version 3.6.0 to 3.8.1:\n\n- Key changes across versions:\n * Dependency upgrades on maven-dependency-analyzer and Doxia\n * Deprecated dependency:sources in favor of dependency:resolve-sources\n * Documentation improvements\n * New dependency analysis goal to check for invalid exclusions\n * New JSON output option for dependency:tree\n * Performance improvements\n * Several bug fixes addressing:\n \u002B The handling of silent parameters\n \u002B The display of the optional flag in the tree\n \u002B The clarity of some error messages\n\nmaven-doxia-sitetools was updated from version 1.11.1 to 2.0.0:\n\n- Key changes across versions:\n * New features: \n \u002B Passing the input filename to the parser\n \u002B Adding a timezone field to the site descriptor\n \u002B Configuring parsers per markup\n * Improvements:\n \u002B Clarifying site descriptor properties\n \u002B Requiring a skin if a site descriptor (site.xml) has been provided\n \u002B Optimization of resource handling\n \u002B Overhauled locale support\n \u002B Refinined menu item display\n \u002B Use of Maven Resolver for artifact resolution\n \u002B Enhanced Velocity context population\n \u002B Automating anchor creation\n * Internal changes:\n \u002B Migration from Plexus to Sisu\n \u002B Upgraded to Java 8\n \u002B Removal of deprecated components and features (such as Maven 1.x support, Google-related properties)\n \u002B Simplified the site model\n \u002B Improved the DocumentRenderer interface/DocumentRenderingContext class API\n * Several bug fixes addressing:\n \u002B The Plexus to Sisu migration\n \u002B Decoration model injection\n \u002B Anchor creation\n \u002B XML character escaping\n \u002B Handling of 0-byte site descriptors\n\nmaven-doxia was updated from version 1.12.0 to 2.0.0:\n\n- Key changes across versions:\n * Improved HTML5 Support: \n \u002B Obsolete attributes and elements were removed\n \u002B CSS styles are now used for styling\n \u002B XHTML5 is now the default HTML implementation, and XHTML(4) is deprecated\n * Improved Markdown Support: \n \u002B A new Markdown sink allows converting content to Markdown. \n \u002B Support for various Markdown features like blockquotes, footnotes, and metadata has been added\n * General Improvements:\n \u002B Dependencies were updated\n \u002B Doxia was upgraded to Java 8\n \u002B Logging and Doxia ID generation were streamlined\n \u002B Migration from Plexus to Sisu\n \u002B Removed deprecated modules and code\n * Several bug fixes addressing:\n \u002B HTML5 incorrect output such as tables, styling and missing or improperly handled attributes\n \u002B Markdown formatting issues\n \u002B Issues with plexus migration\n \u002B Incorrect generation of unique IDs\n \u002B Incorrect anchor generation for document titles\n \u002B Ignored element classes\n\nmaven-invoker-plugin was updated from version 3.2.2 to 3.8.1:\n\n- Key changes across versions:\n * Commons-lang3 was removed\n * Custom Maven executables, external POM files, and more CLI options are now supported\n * Deprecated code was cleaned up\n * Doxia was updated, improving HTML generation and adding Markdown support\n * Groovy was updated, adding support for JDK 19\n * Improved Reporting and Time Handling \n * Enhanced syntax support for invoker properties and Maven options\n * Java 8 is now the minimum supported version\n * Maven 3.6.3 is now the minimum supported version\n * Several dependencies were updated or removed\n * Snapshot update behavior can be controlled\n * Several bug fixes addressing issues with:\n \u002B Dependency resolution\n \u002B Environment variables\n \u002B File handling\n \u002B Report generation\n \u002B Threading\n\nmaven-invoker was updated from version 3.1.0 to 3.3.0:\n\n- Key changes across versions:\n * Added several CLI options. \n * Added support to disable snapshot updates. \n * Added test for inherited environment\n * Custom Maven executables\n * Deprecated code was removed\n * External POM files\n * Fixed issues with builder IDs\n * Improved timeout handling\n * Java 8 is now a requirement\n * Tests were migrated to JUnit 5\n\nmaven-javadoc-plugin was updated from version 3.6.0 to 3.11.1:\n \n- Key changes across versions:\n * Addressed test cleanup and inconsistent default value\n * Automatic release detection for older JDKs\n * Clarified documentation\n * Dependency upgrades of org.codehaus.plexus:plexus-java and Doxia\n * Deprecated the \u0027old\u0027 parameter\n * Improvements include handling of Java 12\u002B links, user settings with invoker, and default author value. \n * Simplified integration tests.\n * Upgraded maven-plugin parent\n * Various bug fixes related to: \n \u002B Toolchains issues\n \u002B Empty JAR creation\n \u002B JDK 10 compatibility\n \u002B Reactor build failures\n \u002B Unit test issues\n \u002B Null pointer exception\n \u002B Issues with skipped reports\n \u002B Stale file detection \n \u002B Log4j dependency dowload\n \u002B Test repository creation\n\nmaven-parent was updated from version 40 to 43:\n\n- Key changes across versions:\n * Potentially breaking changes:\n \u002B Removed dependency on \u0060maven-plugin-annotations\u0060 to better support Maven 4 plugins\n \u002B Removed \u0060checkstyle.violation.ignore\u0060\n * Improved Java 21 support\n * Empty Surefire and PMD reports are now skipped\n * Disabled annotation processing by compiler\n * Various code cleanup and project restructuring tasks\n\nmaven-plugin-tools was updated from version 3.13.0 to 3.15.1:\n\n- Key changes across versions:\n * Doxia and Velocity Engine upgrades\n * New report-no-fork goal \u0027report-no-fork\u0027 which\n will not invoke process-classes\n * Deprecation of o.a.m.plugins.annotations.Component\n * Improved Maven 3 and Maven 4 support\n\nmaven-reporting-api was updated from version 3.1.1 to 4.0.0:\n\n- Key changes across versions:\n * API: Allow MavenReportRenderer.render() and MavenReport.canGenerateReport() to throw exceptions\n * Require locales to be non-null\n * Improve the MavenReport interface and AbstractMavenReport class\n * Removed unused default-report.xml file\n\nmaven-reporting-implementation was updated from version 3.2.0 to 4.0.0:\n\n- Key changes across versions include:\n * Addressed issues with duplicate calls to canGenerateReport()\n * New features such markup output support, flexible section handling and verbatim source rendering\n * Numerous improvements to skinning, rendering, parameter handling, timestamp population and logging\n * Upgrade to Java 8\n\nmaven-surefire was updated from version 3.2.5 to 3.5.2:\n\n- Key changes across versions include:\n * Addressed issues with JUnit5 test reporting, serialization, classpath handling\n and compatibility with newer JDKs.\n * Refined handling of system properties, commons-io usage, parallel test execution\n and report generation.\n * Updated Doxia and commons-compress dependencies\n * Improved documentation, including FAQ fixes\n\nplexus-velocity was updated to version 2.1.0:\n\n- Upgraded Velocity Engine to 2.3\n- Moved to JUnit5\n\nvelocity-engine:\n\n- New package velocity-engine-core implemented at version 2.4", "published": "2021-03-10T00:15:00Z", "severity": "Medium", "epss": 0.22709, "epssPercentile": 0.97735, "priority": "Routine", "priorityTier": 4, "exploited": false, "vendorExploited": false, "disclosed": false, "fixes": [ { "platform": "linux", "product": "maven-dependency-analyzer", "release": "opensuse-leap 15.6", "fixedVersion": "1.15.1-150200.3.10.3", "fix": "SUSE-SU-2025:0719-1", "url": "https://patchblox.com/security/fix/linux/suse-su-2025-0719-1", "released": "2025-02-26T07:25:33Z" }, { "platform": "linux", "product": "maven-dependency-plugin", "release": "opensuse-leap 15.6", "fixedVersion": "3.8.1-150200.3.10.2", "fix": "SUSE-SU-2025:0719-1", "url": "https://patchblox.com/security/fix/linux/suse-su-2025-0719-1", "released": "2025-02-26T07:25:33Z" }, { "platform": "linux", "product": "maven-doxia", "release": "opensuse-leap 15.6", "fixedVersion": "2.0.0-150200.4.18.11", "fix": "SUSE-SU-2025:0719-1", "url": "https://patchblox.com/security/fix/linux/suse-su-2025-0719-1", "released": "2025-02-26T07:25:33Z" }, { "platform": "linux", "product": "maven-doxia-sitetools", "release": "opensuse-leap 15.6", "fixedVersion": "2.0.0-150200.3.18.3", "fix": "SUSE-SU-2025:0719-1", "url": "https://patchblox.com/security/fix/linux/suse-su-2025-0719-1", "released": "2025-02-26T07:25:33Z" }, { "platform": "linux", "product": "maven-invoker", "release": "opensuse-leap 15.6", "fixedVersion": "3.3.0-150200.3.7.5", "fix": "SUSE-SU-2025:0719-1", "url": "https://patchblox.com/security/fix/linux/suse-su-2025-0719-1", "released": "2025-02-26T07:25:33Z" }, { "platform": "linux", "product": "maven-invoker", "release": "sles 15.6", "fixedVersion": "3.3.0-150200.3.7.5", "fix": "SUSE-SU-2025:0719-1", "url": "https://patchblox.com/security/fix/linux/suse-su-2025-0719-1", "released": "2025-02-26T07:25:33Z" }, { "platform": "linux", "product": "maven-invoker-plugin", "release": "opensuse-leap 15.6", "fixedVersion": "3.8.1-150200.3.6.2", "fix": "SUSE-SU-2025:0719-1", "url": "https://patchblox.com/security/fix/linux/suse-su-2025-0719-1", "released": "2025-02-26T07:25:33Z" }, { "platform": "linux", "product": "maven-javadoc-plugin", "release": "opensuse-leap 15.6", "fixedVersion": "3.11.1-150200.4.21.2", "fix": "SUSE-SU-2025:0719-1", "url": "https://patchblox.com/security/fix/linux/suse-su-2025-0719-1", "released": "2025-02-26T07:25:33Z" }, { "platform": "linux", "product": "maven-javadoc-plugin-bootstrap", "release": "opensuse-leap 15.6", "fixedVersion": "3.11.1-150200.4.21.2", "fix": "SUSE-SU-2025:0719-1", "url": "https://patchblox.com/security/fix/linux/suse-su-2025-0719-1", "released": "2025-02-26T07:25:33Z" }, { "platform": "linux", "product": "maven-parent", "release": "opensuse-leap 15.6", "fixedVersion": "43-150200.3.8.2", "fix": "SUSE-SU-2025:0719-1", "url": "https://patchblox.com/security/fix/linux/suse-su-2025-0719-1", "released": "2025-02-26T07:25:33Z" }, { "platform": "linux", "product": "maven-plugin-plugin", "release": "opensuse-leap 15.6", "fixedVersion": "3.15.1-150200.3.15.2", "fix": "SUSE-SU-2025:0719-1", "url": "https://patchblox.com/security/fix/linux/suse-su-2025-0719-1", "released": "2025-02-26T07:25:33Z" }, { "platform": "linux", "product": "maven-plugin-plugin-bootstrap", "release": "opensuse-leap 15.6", "fixedVersion": "3.15.1-150200.3.15.2", "fix": "SUSE-SU-2025:0719-1", "url": "https://patchblox.com/security/fix/linux/suse-su-2025-0719-1", "released": "2025-02-26T07:25:33Z" }, { "platform": "linux", "product": "maven-plugin-tools", "release": "opensuse-leap 15.6", "fixedVersion": "3.15.1-150200.3.15.12", "fix": "SUSE-SU-2025:0719-1", "url": "https://patchblox.com/security/fix/linux/suse-su-2025-0719-1", "released": "2025-02-26T07:25:33Z" }, { "platform": "linux", "product": "maven-plugin-tools", "release": "sles 15.6", "fixedVersion": "3.15.1-150200.3.15.12", "fix": "SUSE-SU-2025:0719-1", "url": "https://patchblox.com/security/fix/linux/suse-su-2025-0719-1", "released": "2025-02-26T07:25:33Z" }, { "platform": "linux", "product": "maven-reporting-api", "release": "opensuse-leap 15.6", "fixedVersion": "4.0.0-150200.3.10.12", "fix": "SUSE-SU-2025:0719-1", "url": "https://patchblox.com/security/fix/linux/suse-su-2025-0719-1", "released": "2025-02-26T07:25:33Z" }, { "platform": "linux", "product": "maven-reporting-impl", "release": "opensuse-leap 15.6", "fixedVersion": "4.0.0-150200.4.9.12", "fix": "SUSE-SU-2025:0719-1", "url": "https://patchblox.com/security/fix/linux/suse-su-2025-0719-1", "released": "2025-02-26T07:25:33Z" }, { "platform": "linux", "product": "maven-surefire", "release": "opensuse-leap 15.6", "fixedVersion": "3.5.2-150200.3.9.20.12", "fix": "SUSE-SU-2025:0719-1", "url": "https://patchblox.com/security/fix/linux/suse-su-2025-0719-1", "released": "2025-02-26T07:25:33Z" }, { "platform": "linux", "product": "maven-surefire", "release": "sles 15.6", "fixedVersion": "3.5.2-150200.3.9.20.12", "fix": "SUSE-SU-2025:0719-1", "url": "https://patchblox.com/security/fix/linux/suse-su-2025-0719-1", "released": "2025-02-26T07:25:33Z" }, { "platform": "linux", "product": "maven-surefire-plugins", "release": "opensuse-leap 15.6", "fixedVersion": "3.5.2-150200.3.9.20.2", "fix": "SUSE-SU-2025:0719-1", "url": "https://patchblox.com/security/fix/linux/suse-su-2025-0719-1", "released": "2025-02-26T07:25:33Z" }, { "platform": "linux", "product": "maven-surefire-plugins", "release": "sles 15.6", "fixedVersion": "3.5.2-150200.3.9.20.2", "fix": "SUSE-SU-2025:0719-1", "url": "https://patchblox.com/security/fix/linux/suse-su-2025-0719-1", "released": "2025-02-26T07:25:33Z" }, { "platform": "linux", "product": "maven-surefire-provider-junit5", "release": "opensuse-leap 15.6", "fixedVersion": "3.5.2-150200.3.9.20.2", "fix": "SUSE-SU-2025:0719-1", "url": "https://patchblox.com/security/fix/linux/suse-su-2025-0719-1", "released": "2025-02-26T07:25:33Z" }, { "platform": "linux", "product": "plexus-velocity", "release": "opensuse-leap 15.6", "fixedVersion": "2.1.0-150200.3.10.3", "fix": "SUSE-SU-2025:0719-1", "url": "https://patchblox.com/security/fix/linux/suse-su-2025-0719-1", "released": "2025-02-26T07:25:33Z" }, { "platform": "linux", "product": "velocity", "release": "Ubuntu 18.04.6 LTS (bionic)", "fixedVersion": "1.7-5ubuntu0.18.04.1~esm1", "fix": "velocity 1.7-5ubuntu0.18.04.1~esm1", "url": "https://patchblox.com/security/fix/linux/ubuntu-bionic-velocity-1.7-5ubuntu0.18.04.1-esm1", "released": "2021-03-10T00:15:00Z" }, { "platform": "linux", "product": "velocity", "release": "Ubuntu 20.04 LTS (focal)", "fixedVersion": "1.7-5\u002Bdeb9u1build0.20.04.1", "fix": "velocity 1.7-5\u002Bdeb9u1build0.20.04.1", "url": "https://patchblox.com/security/fix/linux/ubuntu-focal-velocity-1.7-5-deb9u1build0.20.04.1", "released": "2021-03-10T00:15:00Z" }, { "platform": "linux", "product": "velocity-engine-core", "release": "opensuse-leap 15.6", "fixedVersion": "2.4-150200.5.3.3", "fix": "SUSE-SU-2025:0719-1", "url": "https://patchblox.com/security/fix/linux/suse-su-2025-0719-1", "released": "2025-02-26T07:25:33Z" } ], "noFixYet": [], "dataAsOf": "2026-11-08T13:06:02Z", "attribution": { "text": "Data: Patchblox Patch Radar", "url": "https://patchblox.com/security/patch-radar", "terms": "https://patchblox.com/security/patch-radar/use-the-data" } }