Skip to content
OpenAdvisories
Critical ALAS2023-2023-077 1 CVE

Critical: maven-shared-utils security update (Amazon Linux 2023)

Published Feb 17, 2023 · Updated Feb 22, 2023

Summary

Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2022-29599: org.apache.maven.shared:maven-shared-utils is a functional replacement for plexus-utils in Maven. Affected versions of this package are vulnerable to Command Injection. The Commandline class can emit double-quoted strings without proper escaping, allowing shell injection attacks. The BourneShell class should unconditionally single-quote emitted strings (including the name of the command itself being quoted), with {{\'"\'"\'}} used for embedded single quotes, for maximum safety across shells implementing a superset of POSIX quoting rules.

Fixed packages 2

ReleasePackageFixed in
Amazon Linux · 2023 maven-shared-utils 0:3.3.4-4.amzn2023.0.3
Amazon Linux · 2023 maven-shared-utils-javadoc 0:3.3.4-4.amzn2023.0.3

Vulnerabilities 1

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2022-29599.html