Summary
Maven is a software project management and comprehension tool. Based on the concept of a project object model (POM), Maven can manage a project's build, reporting and documentation from a central piece of information.
Security Fix(es):
* org.codehaus.plexus:plexus-utils: Plexus-utils: Directory Traversal in extractFile method (CVE-2025-67030)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Fixed packages 32
| Release | Package | Fixed in |
|---|---|---|
| AlmaLinux · 9 | aopalliance | 1.0-51.module_el9.6.0+148+fb6dc857 |
| AlmaLinux · 9 | apache-commons-cli | 1.9.0-4.module_el9.6.0+148+fb6dc857 |
| AlmaLinux · 9 | apache-commons-codec | 1.17.1-8.module_el9.6.0+148+fb6dc857 |
| AlmaLinux · 9 | apache-commons-io | 1:2.16.1-9.module_el9.6.0+148+fb6dc857 |
| AlmaLinux · 9 | atinject | 1.0.5-14.module_el9.6.0+148+fb6dc857 |
| AlmaLinux · 9 | google-guice | 5.1.0-23.module_el9.6.0+148+fb6dc857 |
| AlmaLinux · 9 | guava | 33.3.0-5.module_el9.6.0+148+fb6dc857 |
| AlmaLinux · 9 | httpcomponents-client | 4.5.14-21.module_el9.6.0+148+fb6dc857 |
| AlmaLinux · 9 | httpcomponents-core | 4.4.16-21.module_el9.6.0+148+fb6dc857 |
| AlmaLinux · 9 | jakarta-annotations | 1.3.5-38.module_el9.6.0+148+fb6dc857 |
| AlmaLinux · 9 | jansi | 2.4.1-12.module_el9.6.0+148+fb6dc857 |
| AlmaLinux · 9 | jcl-over-slf4j | 1.7.36-9.module_el9.6.0+148+fb6dc857 |
| AlmaLinux · 9 | jsr-305 | 3.0.2-36.module_el9.6.0+148+fb6dc857 |
| AlmaLinux · 9 | maven | 1:3.9.9-13.module_el9.8.0+229+787fb9a7 |
| AlmaLinux · 9 | maven-lib | 1:3.9.9-13.module_el9.8.0+229+787fb9a7 |
| AlmaLinux · 9 | maven-openjdk11 | 1:3.9.9-13.module_el9.8.0+229+787fb9a7 |
| AlmaLinux · 9 | maven-openjdk17 | 1:3.9.9-13.module_el9.8.0+229+787fb9a7 |
| AlmaLinux · 9 | maven-openjdk21 | 1:3.9.9-13.module_el9.8.0+229+787fb9a7 |
| AlmaLinux · 9 | maven-openjdk25 | 1:3.9.9-13.module_el9.8.0+229+787fb9a7 |
| AlmaLinux · 9 | maven-openjdk8 | 1:3.9.9-13.module_el9.8.0+229+787fb9a7 |
| AlmaLinux · 9 | maven-resolver | 1:1.9.22-6.module_el9.6.0+148+fb6dc857 |
| AlmaLinux · 9 | maven-shared-utils | 3.4.2-19.module_el9.6.0+148+fb6dc857 |
| AlmaLinux · 9 | maven-unbound | 1:3.9.9-13.module_el9.8.0+229+787fb9a7 |
| AlmaLinux · 9 | maven-wagon | 3.5.3-17.module_el9.6.0+148+fb6dc857 |
| AlmaLinux · 9 | plexus-cipher | 2.0-25.module_el9.6.0+148+fb6dc857 |
| AlmaLinux · 9 | plexus-classworlds | 2.8.0-9.module_el9.6.0+148+fb6dc857 |
| AlmaLinux · 9 | plexus-containers-component-annotations | 2.2.0-10.module_el9.6.0+148+fb6dc857 |
| AlmaLinux · 9 | plexus-interpolation | 1.27-10.module_el9.6.0+148+fb6dc857 |
| AlmaLinux · 9 | plexus-sec-dispatcher | 2.0-28.module_el9.6.0+148+fb6dc857 |
| AlmaLinux · 9 | plexus-utils | 3.5.1-17.module_el9.8.0+282+e62fc403.1 |
| AlmaLinux · 9 | sisu | 1:0.9.0~M3-7.module_el9.6.0+148+fb6dc857 |
| AlmaLinux · 9 | slf4j | 1.7.36-9.module_el9.6.0+148+fb6dc857 |
Vulnerabilities 1
-
High 8.8
Plexus-Utils has a Directory Traversal vulnerability in its extractFile method
Directory Traversal vulnerability in the extractFile method of org.codehaus.plexus.util.Expand in plexus-utils before 6d780b3378829318ba5c2d29547e0012d5b29642. This allows an attacker to execute arbitrary code