Skip to content
OpenAdvisories
Critical ALAS2-2022-1794 1 CVE

Critical: maven-shared-utils security update (Amazon Linux 2)

Published May 4, 2022 · Updated May 5, 2022

Summary

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2022-29599: org.apache.maven.shared:maven-shared-utils is a functional replacement for plexus-utils in Maven. Affected versions of this package are vulnerable to Command Injection. The Commandline class can emit double-quoted strings without proper escaping, allowing shell injection attacks. The BourneShell class should unconditionally single-quote emitted strings (including the name of the command itself being quoted), with {{'"'"'}} used for embedded single quotes, for maximum safety across shells implementing a superset of POSIX quoting rules.

Fixed packages 2

ReleasePackageFixed in
Amazon Linux · 2 maven-shared-utils 0:0.4-4.amzn2
Amazon Linux · 2 maven-shared-utils-javadoc 0:0.4-4.amzn2

Vulnerabilities 1

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2022-29599.html