Fixed packages 34
| Release | Package | Fixed in |
|---|---|---|
| Red Hat · RHEL 8 enterprise_linux:8::appstream | apache-commons-cli | 0:1.5.0-5.module+el8.10.0+21301+657f54a3 |
| Red Hat · RHEL 8 enterprise_linux:8::appstream | apache-commons-codec | 0:1.15-8.module+el8.10.0+21301+657f54a3 |
| Red Hat · RHEL 8 enterprise_linux:8::appstream | apache-commons-io | 1:2.11.0-3.module+el8.10.0+21301+657f54a3 |
| Red Hat · RHEL 8 enterprise_linux:8::appstream | apache-commons-lang3 | 0:3.12.0-8.module+el8.10.0+21301+657f54a3 |
| Red Hat · RHEL 8 enterprise_linux:8::appstream | atinject | 0:1.0.5-5.module+el8.10.0+21301+657f54a3 |
| Red Hat · RHEL 8 enterprise_linux:8::appstream | cdi-api | 0:2.0.2-7.module+el8.10.0+21301+657f54a3 |
| Red Hat · RHEL 8 enterprise_linux:8::appstream | google-guice | 0:4.2.3-10.module+el8.10.0+21301+657f54a3 |
| Red Hat · RHEL 8 enterprise_linux:8::appstream | guava | 0:31.0.1-5.module+el8.10.0+21301+657f54a3 |
| Red Hat · RHEL 8 enterprise_linux:8::appstream | httpcomponents-client | 0:4.5.13-6.module+el8.10.0+21301+657f54a3 |
| Red Hat · RHEL 8 enterprise_linux:8::appstream | httpcomponents-core | 0:4.4.13-8.module+el8.10.0+21301+657f54a3 |
| Red Hat · RHEL 8 enterprise_linux:8::appstream | jakarta-annotations | 0:1.3.5-15.module+el8.10.0+21301+657f54a3 |
| Red Hat · RHEL 8 enterprise_linux:8::appstream | jansi | 0:2.4.0-7.module+el8.10.0+21301+657f54a3 |
| Red Hat · RHEL 8 enterprise_linux:8::appstream | jansi-debuginfo | 0:2.4.0-7.module+el8.10.0+21301+657f54a3 |
| Red Hat · RHEL 8 enterprise_linux:8::appstream | jansi-debugsource | 0:2.4.0-7.module+el8.10.0+21301+657f54a3 |
| Red Hat · RHEL 8 enterprise_linux:8::appstream | jcl-over-slf4j | 0:1.7.32-5.module+el8.10.0+21301+657f54a3 |
| Red Hat · RHEL 8 enterprise_linux:8::appstream | jsr-305 | 0:3.0.2-7.module+el8.10.0+21301+657f54a3 |
| Red Hat · RHEL 8 enterprise_linux:8::appstream | maven | 1:3.8.5-6.module+el8.10.0+21301+657f54a3 |
| Red Hat · RHEL 8 enterprise_linux:8::appstream | maven-lib | 1:3.8.5-6.module+el8.10.0+21301+657f54a3 |
| Red Hat · RHEL 8 enterprise_linux:8::appstream | maven-openjdk11 | 1:3.8.5-6.module+el8.10.0+21301+657f54a3 |
| Red Hat · RHEL 8 enterprise_linux:8::appstream | maven-openjdk17 | 1:3.8.5-6.module+el8.10.0+21301+657f54a3 |
| Red Hat · RHEL 8 enterprise_linux:8::appstream | maven-openjdk21 | 1:3.8.5-6.module+el8.10.0+21301+657f54a3 |
| Red Hat · RHEL 8 enterprise_linux:8::appstream | maven-openjdk8 | 1:3.8.5-6.module+el8.10.0+21301+657f54a3 |
| Red Hat · RHEL 8 enterprise_linux:8::appstream | maven-resolver | 1:1.7.3-6.module+el8.10.0+21301+657f54a3 |
| Red Hat · RHEL 8 enterprise_linux:8::appstream | maven-shared-utils | 0:3.3.4-6.module+el8.10.0+21301+657f54a3 |
| Red Hat · RHEL 8 enterprise_linux:8::appstream | maven-wagon | 0:3.5.1-3.module+el8.10.0+21301+657f54a3 |
| Red Hat · RHEL 8 enterprise_linux:8::appstream | plexus-cipher | 0:2.0-3.module+el8.10.0+21301+657f54a3 |
| Red Hat · RHEL 8 enterprise_linux:8::appstream | plexus-classworlds | 0:2.6.0-13.module+el8.10.0+21301+657f54a3 |
| Red Hat · RHEL 8 enterprise_linux:8::appstream | plexus-containers | 0:2.1.1-3.module+el8.10.0+21301+657f54a3 |
| Red Hat · RHEL 8 enterprise_linux:8::appstream | plexus-containers-component-annotations | 0:2.1.1-3.module+el8.10.0+21301+657f54a3 |
| Red Hat · RHEL 8 enterprise_linux:8::appstream | plexus-interpolation | 0:1.26-13.module+el8.10.0+21301+657f54a3 |
| Red Hat · RHEL 8 enterprise_linux:8::appstream | plexus-sec-dispatcher | 0:2.0-5.module+el8.10.0+21301+657f54a3 |
| Red Hat · RHEL 8 enterprise_linux:8::appstream | plexus-utils | 0:3.3.0-11.module+el8.10.0+24366+080b405b.1 |
| Red Hat · RHEL 8 enterprise_linux:8::appstream | sisu | 1:0.3.5-3.module+el8.10.0+21301+657f54a3 |
| Red Hat · RHEL 8 enterprise_linux:8::appstream | slf4j | 0:1.7.32-5.module+el8.10.0+21301+657f54a3 |
Vulnerabilities 1
-
High 8.8
Plexus-Utils has a Directory Traversal vulnerability in its extractFile method
Directory Traversal vulnerability in the extractFile method of org.codehaus.plexus.util.Expand in plexus-utils before 6d780b3378829318ba5c2d29547e0012d5b29642. This allows an attacker to execute arbitrary code
References
-
article
https://access.redhat.com/security/updates/classification/#important
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2451409
-
advisory
https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_40841.json
-
report
https://access.redhat.com/security/cve/CVE-2025-67030
-
advisory
https://www.cve.org/CVERecord?id=CVE-2025-67030
-
advisory
https://nvd.nist.gov/vuln/detail/CVE-2025-67030
-
article
https://gist.github.com/weaver4VD/3216dac645220f8c9b488362f61241ec
-
article
https://github.com/codehaus-plexus/plexus-utils/commit/6d780b3378829318ba5c2d29547e0012d5b29642
-
article
https://github.com/codehaus-plexus/plexus-utils/issues/294
-
article
https://github.com/codehaus-plexus/plexus-utils/pull/295
-
article
https://github.com/codehaus-plexus/plexus-utils/pull/296