Critical USN-6730-1 1 CVE

maven-shared-utils vulnerability

Published Apr 11, 2024 · Updated Jun 29, 2026

Ecosystem: Ubuntu

Summary

It was discovered that Apache Maven Shared Utils did not handle double-quoted
strings properly, allowing shell injection attacks. This could allow an
attacker to run arbitrary code.

Fixed packages 5

Release	Package	Fixed in
Ubuntu · 20.04 LTS 20.04:LTS	maven-shared-utils	3.3.0-1ubuntu0.20.04.1
Ubuntu · 22.04 LTS 22.04:LTS	maven-shared-utils	3.3.0-1ubuntu0.22.04.1
Ubuntu · Pro 14.04 LTS Pro:14.04:LTS	maven-shared-utils	0.4-1ubuntu0.1~esm1
Ubuntu · Pro 16.04 LTS Pro:16.04:LTS	maven-shared-utils	0.9-1ubuntu0.1~esm1
Ubuntu · Pro 18.04 LTS Pro:18.04:LTS	maven-shared-utils	3.3.0-1ubuntu0.18.04.1~esm1

Vulnerabilities 1

Critical 9.8

CVE-2022-29599

Commandline class shell injection vulnerabilities

In Apache Maven maven-shared-utils prior to version 3.3.3, the Commandline class can emit double-quoted strings without proper escaping, allowing shell injection attacks.

Apache Software Foundation Apache Maven maven-shared-utils org.apache.maven.shared:maven-shared-utils Debian Ubuntu Maven

May 23, 2022

References

report
https://ubuntu.com/security/CVE-2022-29599