Description
Plexus-utils before 3.0.16 is vulnerable to command injection because it does not correctly process the contents of double quoted strings.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | plexus-utils2 | 3.0.22-1 | — |
| Debian 13 | plexus-utils2 | 3.0.22-1 | — |
| Debian 12 | plexus-utils2 | 3.0.22-1 | — |
| Debian 9 | plexus-utils | 1:1.5.15-4+deb9u1 | DSA-4146-1 |
| Debian 8 | plexus-utils | 1:1.5.15-4+deb8u1 | DSA-4146-1 |
| Debian 8 | plexus-utils2 | 3.0.15-1+deb8u1 | DSA-4149-1 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 7 | plexus-utils | 1:1.5.15-4+deb7u1 | DLA-1236-1 |
| Debian 7 | plexus-utils2 | 2.0.5-1+deb7u1 | DLA-1237-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 16.04 LTS | plexus-utils | 1:1.5.15-4+deb8u1build0.16.04.1 | — |
| Ubuntu 14.04 LTS | plexus-utils | 1:1.5.15-4+deb8u1build0.14.04.1 | — |
| Ubuntu 14.04 LTS | plexus-utils2 | 2.0.5-1+deb7u1build0.14.04.1 | — |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
GitHub 1 repository
-
shoucheng3/codehaus-plexus__plexus-utils_CVE-2017-1000487_3-0-15 ★ 0 · Aug 19, 2025
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.codehaus.plexus:plexus-utils | < 3.0.16 | 3.0.16 | GHSA-8vhq-qq4p-grq3 |
Advisories 6
- DSA-4146-1 plexus-utils - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-4149-1 plexus-utils2 - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DLA-1237-1 plexus-utils2 - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DLA-1236-1 plexus-utils - security update Debian Security (DSA / DLA) · Mar 9, 2026
- WID-SEC-2026-0180 Dell Data Protection Advisor: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jan 20, 2026
- WID-SEC-2022-1375 JFrog Artifactory: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 12, 2025
References
- RHSA-2018:1322 vendor-advisory
- [debian-lts-announce] 20180109 [SECURITY] [DLA 1237-1] plexus-utils2 security update mailing-list
- https://snyk.io/vuln/SNYK-JAVA-ORGCODEHAUSPLEXUS-31522
- DSA-4149 vendor-advisory
- DSA-4146 vendor-advisory
- https://github.com/codehaus-plexus/plexus-utils/commit/b38a1b3a4352303e4312b2bb601a0d7ec6e28f41
- [debian-lts-announce] 20180109 [SECURITY] [DLA 1236-1] plexus-utils security update mailing-list
- [druid-commits] 20191115 [GitHub] [incubator-druid] ccaominh opened a new pull request #8878: Address security vulnerabilities mailing-list
- [avro-dev] 20200619 [jira] [Created] (AVRO-2865) Security vulnerability caused by plexus-utils:1.5.6 mailing-list
- [pulsar-commits] 20201215 [GitHub] [pulsar] yanshuchong opened a new issue #8967: CVSS issue list mailing-list
- [pulsar-commits] 20210127 [GitHub] [pulsar] GLouMcK opened a new issue #9347: Security Vulnerabilities - Black Duck Scan mailing-list