Summary
The Apache Maven Shared Utils project aims to be an improved functional replacement for plexus-utils in Maven.
Security Fix(es):
* maven-shared-utils: Command injection via Commandline class (CVE-2022-29599)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Fixed packages 44
| Release | Package | Fixed in |
|---|---|---|
| AlmaLinux · 8 | aopalliance | 1.0-17.module_el8.6.0+2752+f1f3449e |
| AlmaLinux · 8 | apache-commons-cli | 1.4-4.module_el8.6.0+2752+f1f3449e |
| AlmaLinux · 8 | apache-commons-codec | 1.11-3.module_el8.6.0+2752+f1f3449e |
| AlmaLinux · 8 | apache-commons-io | 1:2.6-3.module_el8.6.0+2752+f1f3449e |
| AlmaLinux · 8 | apache-commons-lang3 | 3.7-3.module_el8.6.0+2752+f1f3449e |
| AlmaLinux · 8 | apache-commons-logging | 1.2-13.module_el8.6.0+2752+f1f3449e |
| AlmaLinux · 8 | atinject | 1-28.20100611svn86.module_el8.6.0+2752+f1f3449e |
| AlmaLinux · 8 | cdi-api | 1.2-8.module_el8.6.0+2752+f1f3449e |
| AlmaLinux · 8 | geronimo-annotation | 1.0-23.module_el8.6.0+2752+f1f3449e |
| AlmaLinux · 8 | glassfish-el-api | 3.0.1-0.7.b08.module_el8.6.0+2752+f1f3449e |
| AlmaLinux · 8 | google-guice | 4.1-11.module_el8.6.0+2752+f1f3449e |
| AlmaLinux · 8 | guava20 | 20.0-8.module_el8.6.0+2752+f1f3449e |
| AlmaLinux · 8 | hawtjni-runtime | 1.16-2.module_el8.6.0+2752+f1f3449e |
| AlmaLinux · 8 | httpcomponents-client | 4.5.5-5.module_el8.6.0+2752+f1f3449e |
| AlmaLinux · 8 | httpcomponents-core | 4.4.10-3.module_el8.6.0+2752+f1f3449e |
| AlmaLinux · 8 | jansi | 1.17.1-1.module_el8.6.0+2752+f1f3449e |
| AlmaLinux · 8 | jansi | 1.17.1-1.module_el8.0.0+6044+f3cbc35d |
| AlmaLinux · 8 | jansi-native | 1.7-7.module_el8.6.0+2752+f1f3449e |
| AlmaLinux · 8 | jboss-interceptors-1.2-api | 1.0.0-8.module_el8.6.0+2752+f1f3449e |
| AlmaLinux · 8 | jcl-over-slf4j | 1.7.25-4.module_el8.6.0+2752+f1f3449e |
| AlmaLinux · 8 | jsoup | 1.11.3-3.module_el8.6.0+2752+f1f3449e |
| AlmaLinux · 8 | maven | 1:3.5.4-5.module_el8.6.0+2752+f1f3449e |
| AlmaLinux · 8 | maven-lib | 1:3.5.4-5.module_el8.6.0+2752+f1f3449e |
| AlmaLinux · 8 | maven-resolver-api | 1:1.1.1-2.module_el8.6.0+2752+f1f3449e |
| AlmaLinux · 8 | maven-resolver-connector-basic | 1:1.1.1-2.module_el8.6.0+2752+f1f3449e |
| AlmaLinux · 8 | maven-resolver-impl | 1:1.1.1-2.module_el8.6.0+2752+f1f3449e |
| AlmaLinux · 8 | maven-resolver-spi | 1:1.1.1-2.module_el8.6.0+2752+f1f3449e |
| AlmaLinux · 8 | maven-resolver-transport-wagon | 1:1.1.1-2.module_el8.6.0+2752+f1f3449e |
| AlmaLinux · 8 | maven-resolver-util | 1:1.1.1-2.module_el8.6.0+2752+f1f3449e |
| AlmaLinux · 8 | maven-shared-utils | 3.2.1-0.2.module_el8.6.0+2902+097a4293 |
| AlmaLinux · 8 | maven-wagon-file | 3.1.0-1.module_el8.6.0+2752+f1f3449e |
| AlmaLinux · 8 | maven-wagon-http | 3.1.0-1.module_el8.6.0+2752+f1f3449e |
| AlmaLinux · 8 | maven-wagon-http-shared | 3.1.0-1.module_el8.6.0+2752+f1f3449e |
| AlmaLinux · 8 | maven-wagon-provider-api | 3.1.0-1.module_el8.6.0+2752+f1f3449e |
| AlmaLinux · 8 | plexus-cipher | 1.7-14.module_el8.6.0+2752+f1f3449e |
| AlmaLinux · 8 | plexus-classworlds | 2.5.2-9.module_el8.6.0+2752+f1f3449e |
| AlmaLinux · 8 | plexus-containers-component-annotations | 1.7.1-8.module_el8.6.0+2752+f1f3449e |
| AlmaLinux · 8 | plexus-interpolation | 1.22-9.module_el8.6.0+2752+f1f3449e |
| AlmaLinux · 8 | plexus-sec-dispatcher | 1.4-26.module_el8.6.0+2752+f1f3449e |
| AlmaLinux · 8 | plexus-utils | 3.1.0-3.module_el8.6.0+2752+f1f3449e |
| AlmaLinux · 8 | sisu-inject | 1:0.3.3-6.module_el8.6.0+2752+f1f3449e |
| AlmaLinux · 8 | sisu-plexus | 1:0.3.3-6.module_el8.6.0+2752+f1f3449e |
| AlmaLinux · 8 | slf4j | 1.7.25-4.module_el8.6.0+2752+f1f3449e |
| AlmaLinux · 8 | slf4j | 1.7.25-4.module_el8.5.0+2577+9e95fe00 |
Vulnerabilities 1
-
Critical 9.8
Commandline class shell injection vulnerabilities
In Apache Maven maven-shared-utils prior to version 3.3.3, the Commandline class can emit double-quoted strings without proper escaping, allowing shell injection attacks.
References
-
report
https://vulners.com/cve/CVE-2022-29599