Summary
The Apache Maven Shared Utils project aims to be an improved functional replacement for plexus-utils in Maven.
Security Fix(es):
* maven-shared-utils: Command injection via Commandline class (CVE-2022-29599)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Fixed packages 54
| Release | Package | Fixed in |
|---|---|---|
| Rocky Linux · 8 | aopalliance | 0:1.0-20.module+el8.6.0+844+4401f2ed |
| Rocky Linux · 8 | aopalliance | 0:1.0-20.module+el8.3.0+134+f7791fe0 |
| Rocky Linux · 8 | apache-commons-cli | 0:1.4-7.module+el8.6.0+844+4401f2ed |
| Rocky Linux · 8 | apache-commons-cli | 0:1.4-7.module+el8.3.0+134+f7791fe0 |
| Rocky Linux · 8 | apache-commons-codec | 0:1.13-3.module+el8.6.0+844+4401f2ed |
| Rocky Linux · 8 | apache-commons-codec | 0:1.13-3.module+el8.3.0+134+f7791fe0 |
| Rocky Linux · 8 | apache-commons-io | 1:2.6-6.module+el8.6.0+844+4401f2ed |
| Rocky Linux · 8 | apache-commons-io | 1:2.6-6.module+el8.3.0+134+f7791fe0 |
| Rocky Linux · 8 | apache-commons-lang3 | 0:3.9-4.module+el8.6.0+844+4401f2ed |
| Rocky Linux · 8 | apache-commons-lang3 | 0:3.9-4.module+el8.3.0+134+f7791fe0 |
| Rocky Linux · 8 | atinject | 0:1-31.20100611svn86.module+el8.6.0+844+4401f2ed |
| Rocky Linux · 8 | atinject | 0:1-31.20100611svn86.module+el8.3.0+134+f7791fe0 |
| Rocky Linux · 8 | cdi-api | 0:2.0.1-3.module+el8.6.0+844+4401f2ed |
| Rocky Linux · 8 | cdi-api | 0:2.0.1-3.module+el8.3.0+134+f7791fe0 |
| Rocky Linux · 8 | geronimo-annotation | 0:1.0-26.module+el8.6.0+844+4401f2ed |
| Rocky Linux · 8 | geronimo-annotation | 0:1.0-26.module+el8.3.0+134+f7791fe0 |
| Rocky Linux · 8 | google-guice | 0:4.2.2-4.module+el8.6.0+844+4401f2ed |
| Rocky Linux · 8 | google-guice | 0:4.2.2-4.module+el8.3.0+134+f7791fe0 |
| Rocky Linux · 8 | guava | 0:28.1-3.module+el8.6.0+844+4401f2ed |
| Rocky Linux · 8 | guava | 0:28.1-3.module+el8.3.0+134+f7791fe0 |
| Rocky Linux · 8 | httpcomponents-client | 0:4.5.10-3.module+el8.3.0+134+f7791fe0 |
| Rocky Linux · 8 | httpcomponents-client | 0:4.5.10-4.module+el8.6.0+844+4401f2ed |
| Rocky Linux · 8 | httpcomponents-core | 0:4.4.12-3.module+el8.6.0+844+4401f2ed |
| Rocky Linux · 8 | httpcomponents-core | 0:4.4.12-3.module+el8.3.0+134+f7791fe0 |
| Rocky Linux · 8 | jansi | 0:1.18-4.module+el8.6.0+844+4401f2ed |
| Rocky Linux · 8 | jansi | 0:1.18-4.module+el8.3.0+134+f7791fe0 |
| Rocky Linux · 8 | jsoup | 0:1.12.1-3.module+el8.6.0+844+4401f2ed |
| Rocky Linux · 8 | jsoup | 0:1.12.1-3.module+el8.3.0+134+f7791fe0 |
| Rocky Linux · 8 | jsr-305 | 0:0-0.25.20130910svn.module+el8.6.0+844+4401f2ed |
| Rocky Linux · 8 | jsr-305 | 0:0-0.25.20130910svn.module+el8.3.0+134+f7791fe0 |
| Rocky Linux · 8 | maven | 1:3.6.2-6.module+el8.4.0+648+3fecd521 |
| Rocky Linux · 8 | maven | 1:3.6.2-7.module+el8.6.0+976+839b99e9 |
| Rocky Linux · 8 | maven | 1:3.6.2-7.module+el8.6.0+844+4401f2ed |
| Rocky Linux · 8 | maven-resolver | 0:1.4.1-3.module+el8.6.0+844+4401f2ed |
| Rocky Linux · 8 | maven-resolver | 0:1.4.1-3.module+el8.3.0+134+f7791fe0 |
| Rocky Linux · 8 | maven-shared-utils | 0:3.2.1-0.5.module+el8.6.0+976+839b99e9 |
| Rocky Linux · 8 | maven-wagon | 0:3.3.4-2.module+el8.6.0+844+4401f2ed |
| Rocky Linux · 8 | maven-wagon | 0:3.3.4-2.module+el8.3.0+134+f7791fe0 |
| Rocky Linux · 8 | plexus-cipher | 0:1.7-17.module+el8.6.0+844+4401f2ed |
| Rocky Linux · 8 | plexus-cipher | 0:1.7-17.module+el8.3.0+134+f7791fe0 |
| Rocky Linux · 8 | plexus-classworlds | 0:2.6.0-4.module+el8.6.0+844+4401f2ed |
| Rocky Linux · 8 | plexus-classworlds | 0:2.6.0-4.module+el8.3.0+134+f7791fe0 |
| Rocky Linux · 8 | plexus-containers | 0:2.1.0-2.module+el8.6.0+844+4401f2ed |
| Rocky Linux · 8 | plexus-containers | 0:2.1.0-2.module+el8.3.0+134+f7791fe0 |
| Rocky Linux · 8 | plexus-interpolation | 0:1.26-3.module+el8.6.0+844+4401f2ed |
| Rocky Linux · 8 | plexus-interpolation | 0:1.26-3.module+el8.3.0+134+f7791fe0 |
| Rocky Linux · 8 | plexus-sec-dispatcher | 0:1.4-29.module+el8.6.0+844+4401f2ed |
| Rocky Linux · 8 | plexus-sec-dispatcher | 0:1.4-29.module+el8.3.0+134+f7791fe0 |
| Rocky Linux · 8 | plexus-utils | 0:3.3.0-3.module+el8.6.0+844+4401f2ed |
| Rocky Linux · 8 | plexus-utils | 0:3.3.0-3.module+el8.3.0+134+f7791fe0 |
| Rocky Linux · 8 | sisu | 0:0.3.4-2.module+el8.6.0+844+4401f2ed |
| Rocky Linux · 8 | sisu | 0:0.3.4-2.module+el8.3.0+134+f7791fe0 |
| Rocky Linux · 8 | slf4j | 0:1.7.28-3.module+el8.6.0+844+4401f2ed |
| Rocky Linux · 8 | slf4j | 0:1.7.28-3.module+el8.3.0+134+f7791fe0 |
Vulnerabilities 1
-
Critical 9.8
Commandline class shell injection vulnerabilities
In Apache Maven maven-shared-utils prior to version 3.3.3, the Commandline class can emit double-quoted strings without proper escaping, allowing shell injection attacks.
References
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2066479