Red Hat Security Advisory

RHSA-2022:1541

maven-shared-utils security update

Released 2022-04-26 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat Enterprise Linux Client Optional (v. 7) maven-shared-utils-0.4-4.el7_9, maven-shared-utils-javadoc-0.4-4.el7_9
Red Hat Enterprise Linux ComputeNode Optional (v. 7) maven-shared-utils-0.4-4.el7_9, maven-shared-utils-javadoc-0.4-4.el7_9
Red Hat Enterprise Linux Server Optional (v. 7) maven-shared-utils-0.4-4.el7_9, maven-shared-utils-javadoc-0.4-4.el7_9
Red Hat Enterprise Linux Workstation Optional (v. 7) maven-shared-utils-0.4-4.el7_9, maven-shared-utils-javadoc-0.4-4.el7_9

Fixes 1 record

TI-2022-12034 CVE-2022-29599 · GHSA-rhgr-952r-6p8q

Commandline class shell injection vulnerabilities

MEDIUM 49

In Apache Maven maven-shared-utils prior to version 3.3.3, the Commandline class can emit double-quoted strings without proper escaping, allowing shell injection attacks.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.04423 Published 2022-05-23 Partial fix · 3.3.3 CWE-116