Vulnerability · Published Jan 31, 2025 · Assigned by GitHub_M
CVE-2025-23215PMD Designer's release key passphrase (GPG) available on Maven Central in cleartext
Critical 9.3
In plain English
A critical-severity information exposure in pmd from pmd. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 26% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
PMD is an extensible multilanguage static code analyzer. The passphrase for the PMD and PMD Designer release signing keys are included in jar published to Maven Central. The private key itself is not known to have been compromised itself, but given its passphrase is, it must also be considered potentially compromised. As a mitigation, both compromised keys have been revoked so that no future use of the keys are possible. Note, that the published artifacts in Maven Central under the group id net.sourceforge.pmd are not compromised and the signatures are valid.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Maven | net.sourceforge.pmd:pmd-core | 7.10.0 | GHSA-88m4-h43f-wx84 |
| Maven | net.sourceforge.pmd:pmd-designer | 7.10.0 | GHSA-88m4-h43f-wx84 |
| Maven | net.sourceforge.pmd:pmd-ui | no fix listed | GHSA-88m4-h43f-wx84 |
Affected products (as reported)
Weakness: CWE-200, CWE-540, CWE-312 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/U:Clear