Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
Apache Maven, Sisu, and Plexus Testing Updated to Fix Security and Performance Issues
published 5 months ago
Summary
Several open-source projects, including Apache Maven, Sisu, and Plexus Testing, have been updated to fix security and performance issues. The updates address potential timing attacks in SCRAM authentication, fix bugs in Maven's plugin management, and improve performance by upgrading to newer versions of various dependencies. These updates are recommended to ensure the security and stability of your systems.
Original advisory text
Security update for ongres-scram, ongres-stringprep, plexus-testing, maven, maven-doxia, mojo-parent, sisu
This update for ongres-scram, ongres-stringprep, plexus-testing, maven, maven-doxia, mojo-parent, sisu fixes the following issues:
Changes in ongres-scram:
- Version 3.2
* Fix Timing Attack Vulnerability in SCRAM Authentication
(bsc#1250399, CVE-2025-59432)
* Updated dependencies and maven plugins
* Use central-publishing-maven-plugin to deploy to Maven Central.
- Do not create multirelease jar if the only Java 9+ class file is
module-info.class
Changes in ongres-stringprep:
- Do not create multirelease jar if the only Java 9+ class file is
module-info.class
Changes in plexus-testing:
- The build without tests does not need the full junit5; the
junit5-minimal (built with ant) is enough
Changes in maven:
- Upgrade to upstream version 3.9.14
* Bug Fixes
+ plexus-testing dependencies should be used in test scope
- Upgrade to upstream version 3.9.13
* Bug Fixes
+ Bug: SecDispatcher is managed by legacy Plexus DI
+ [3.9.x] MavenPluginJavaPrerequisiteChecker: Handle 8/1.8
Java version in ranges as well
* Maintenance
+ Update Maven plugin versions in default-bindings.xml
+ Migrate to JUnit 5 - avoid using TestCase
Changes in maven-doxia:
Upgrade to upstream version 2.1.0:
* New features and improvements
+ Distinguish between linebreaks for formatting markup and
linebreaks in output
+ Return SinkEventAttributes instead of super class
MutableAttributeSet for filterAttributes
+ Optionally leave fragments of internal links untouched
Support strikethrough for Markdown sink
+ DOXIA-770: Only escape when necessary
+ DOXIA-760: Clarify table justification semantics and introduce
new "JUSTIFY_DEFAULT" alignment
+ DOXIA-756: Allow to customize macro execution
+ DOXIA-759: Support anchors in MarkdownSink
* Bug Fixes
+ MarkdownSink: Fix verbatim inside table cell
+ Make sure to emit metadata prior everything else
+ Convert all globally available attributes to HTML5 compliant
ones
+ Html5BaseSink: Convert non-compliant HTML5 attributes to
compliant ones
+ Support "name" attribute in "a" element still in XHTML5
+ Never emit Markdown inside HTML context
+ Use JSoup to convert HTML to XHTML after parsing with Flexmark
+ DOXIA-764: Strip leading newline after
+ DOXIA-763: Distinguish between verbatim source and non-source
in MarkdownSink
+ DOXIA-758: Consider emitComments flag in MarkdownSink
+ DOXIA-757: Don't strip leading "#" from link names
+ DOXIA-753: Do not end lists with a blank line
+ DOXIA-751: Linked inline code must be emitted in right order
+ DOXIA-749: Correctly indent and separate blocks inside list
items
+ DOXIA-750: Properly apply inlines inside HTML blocks
+ DOXIA-747: Emit headings at beginning of line for Markdown
* Documentation updates
+ Site: Convert APT to Markdown
+ Improve documentation of supported extensions
+ (doc) Fix missing references in JavaDocs
* Maintenance
+ Cleanup tests
+ JUnit Jupiter best practices
+ Remove commons-lang3 and commons-text dependencies
+ feat: enable prevent branch protection rules
+ Cleanup pom, remove redundant dependencies
+ Drop almost all usages of plexus-utils
+ Remove not used and outdated clirr-maven-plugin
+ Enable Github Issues
+ DOXIA-772: Deprecate Sink.sectionTitle() and sectionTitle_()
+ DOXIA-754: Clarify method order for nested lists
Changes in mojo-parent:
- Do not import junit-bom in the parent. This creates unnecessary
build cycles with junit5.
Changes in ongres-scram:
- Version 3.2
* Fix Timing Attack Vulnerability in SCRAM Authentication
(bsc#1250399, CVE-2025-59432)
* Updated dependencies and maven plugins
* Use central-publishing-maven-plugin to deploy to Maven Central.
- Do not create multirelease jar if the only Java 9+ class file is
module-info.class
Changes in ongres-stringprep:
- Do not create multirelease jar if the only Java 9+ class file is
module-info.class
Changes in plexus-testing:
- The build without tests does not need the full junit5; the
junit5-minimal (built with ant) is enough
Changes in maven:
- Upgrade to upstream version 3.9.14
* Bug Fixes
+ plexus-testing dependencies should be used in test scope
- Upgrade to upstream version 3.9.13
* Bug Fixes
+ Bug: SecDispatcher is managed by legacy Plexus DI
+ [3.9.x] MavenPluginJavaPrerequisiteChecker: Handle 8/1.8
Java version in ranges as well
* Maintenance
+ Update Maven plugin versions in default-bindings.xml
+ Migrate to JUnit 5 - avoid using TestCase
Changes in maven-doxia:
Upgrade to upstream version 2.1.0:
* New features and improvements
+ Distinguish between linebreaks for formatting markup and
linebreaks in output
+ Return SinkEventAttributes instead of super class
MutableAttributeSet for filterAttributes
+ Optionally leave fragments of internal links untouched
Support strikethrough for Markdown sink
+ DOXIA-770: Only escape when necessary
+ DOXIA-760: Clarify table justification semantics and introduce
new "JUSTIFY_DEFAULT" alignment
+ DOXIA-756: Allow to customize macro execution
+ DOXIA-759: Support anchors in MarkdownSink
* Bug Fixes
+ MarkdownSink: Fix verbatim inside table cell
+ Make sure to emit metadata prior everything else
+ Convert all globally available attributes to HTML5 compliant
ones
+ Html5BaseSink: Convert non-compliant HTML5 attributes to
compliant ones
+ Support "name" attribute in "a" element still in XHTML5
+ Never emit Markdown inside HTML context
+ Use JSoup to convert HTML to XHTML after parsing with Flexmark
+ DOXIA-764: Strip leading newline after
+ DOXIA-763: Distinguish between verbatim source and non-source
in MarkdownSink
+ DOXIA-758: Consider emitComments flag in MarkdownSink
+ DOXIA-757: Don't strip leading "#" from link names
+ DOXIA-753: Do not end lists with a blank line
+ DOXIA-751: Linked inline code must be emitted in right order
+ DOXIA-749: Correctly indent and separate blocks inside list
items
+ DOXIA-750: Properly apply inlines inside HTML blocks
+ DOXIA-747: Emit headings at beginning of line for Markdown
* Documentation updates
+ Site: Convert APT to Markdown
+ Improve documentation of supported extensions
+ (doc) Fix missing references in JavaDocs
* Maintenance
+ Cleanup tests
+ JUnit Jupiter best practices
+ Remove commons-lang3 and commons-text dependencies
+ feat: enable prevent branch protection rules
+ Cleanup pom, remove redundant dependencies
+ Drop almost all usages of plexus-utils
+ Remove not used and outdated clirr-maven-plugin
+ Enable Github Issues
+ DOXIA-772: Deprecate Sink.sectionTitle() and sectionTitle_()
+ DOXIA-754: Clarify method order for nested lists
Changes in mojo-parent:
- Do not import junit-bom in the parent. This creates unnecessary
build cycles with junit5.
References
- https://bugzilla.suse.com/1250399 Third Party Advisory
- https://www.suse.com/security/cve/CVE-2025-59432 URL
Timeline
Published12 May 2026
Updated19 May 2026
First seen19 May 2026
Sources
openSUSE-SU-2026:20742-1 · OSV
Track software like this
Free during beta